Unscored severity · published Oct 27, 2013
CVE-2013-4428
OpenStack Image Registry and Delivery Service (Glance) Folsom, Grizzly before 2013.1.4, and Havana before 2013.2, when the download_image policy is configured, does not properly…
–
CVSS
3.1%
EPSS
No
On KEV
Description
OpenStack Image Registry and Delivery Service (Glance) Folsom, Grizzly before 2013.1.4, and Havana before 2013.2, when the download_image policy is configured, does not properly restrict access to cached images, which allows remote authenticated users to read otherwise restricted images via an image UUID.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.1% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GL
Glance · Openstack
2012.2 through 2012.2.4; 2013.1 before 2013.1.4; 2013.2; 2013.2; 2013.2 · source: NVD
UL
Ubuntu Linux · Canonical
12.10; 13.04 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-4428
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-4428
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-1525.html
Mailing List
http://www.openwall.com/lists/oss-security/2013/10/15/8
Mailing List
http://www.openwall.com/lists/oss-security/2013/10/16/9
Third Party Advisory
http://www.securityfocus.com/bid/63159
Third Party Advisory
http://www.ubuntu.com/usn/USN-2003-1
Exploit
https://bugs.launchpad.net/glance/+bug/1235226
More from Ubuntu Linux
9.8
CVE-2020-11651
SaltStack Salt Authentication Bypass Vulnerability
9.8
CVE-2020-7247
OpenSMTPD Remote Code Execution Vulnerability
9.8
CVE-2019-11043
Underflow in PHP-FPM can lead to RCE
9.8
CVE-2019-16928
Exim Out-of-bounds Write Vulnerability
9.8
CVE-2019-10149
Exim Mail Transfer Agent (MTA) Improper Input Validation