Unscored severity · published May 14, 2014
CVE-2013-4471
The Identity v3 API in OpenStack Dashboard (Horizon) before 2013.2 does not require the current password when changing passwords for user accounts, which makes it easier for…
–
CVSS
1.2%
EPSS
No
On KEV
Description
The Identity v3 API in OpenStack Dashboard (Horizon) before 2013.2 does not require the current password when changing passwords for user accounts, which makes it easier for remote attackers to change a user password by leveraging the authentication token for that user.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HO
Horizon · Openstack
2013.1 before 2013.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-4471
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-4471
Vendor Advisory
http://lists.openstack.org/pipermail/openstack/2013-November/003299.html
Issue Tracking
https://bugs.launchpad.net/horizon/+bug/1237989
More from Horizon
6.8
CVE-2026-55748
OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters
6.1
CVE-2022-45582
Open Redirect vulnerability in Horizon Web Dashboard 19.4.0 thru 20.1.4 via the success_url parameter
6.1
CVE-2020-29565
An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x
5.5
CVE-2012-5476
Within the RHOS Essex Preview (2012.2) of the OpenStack dashboard package, the file /etc/quantum/quantum.conf is world readable which exposes the admin password and token value
5.5
CVE-2012-5474
The file /etc/openstack-dashboard/local_settings within Red Hat OpenStack Platform 2.0 and RHOS Essex Release (python-django-horizon package before 2012.1.1) is world readable and…