Unscored severity · published Nov 5, 2013
CVE-2013-4497
The XenAPI backend in OpenStack Compute (Nova) Folsom, Grizzly, and Havana before 2013.2 does not properly apply security groups (1) when resizing an image or (2) during live…
–
CVSS
1.8%
EPSS
No
On KEV
Description
The XenAPI backend in OpenStack Compute (Nova) Folsom, Grizzly, and Havana before 2013.2 does not properly apply security groups (1) when resizing an image or (2) during live migration, which allows remote attackers to bypass intended restrictions.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
Folsom · Openstack
All versions, or not specified · source: NVD
GR
Grizzly · Openstack
All versions, or not specified · source: NVD
HA
Havana · Openstack
through havana-3; havana-1; havana-2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-4497
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-4497
www.openwall.com
http://www.openwall.com/lists/oss-security/2013/11/03/2
www.openwall.com
http://www.openwall.com/lists/oss-security/2013/11/03/3
bugs.launchpad.net
https://bugs.launchpad.net/nova/+bug/1073306
bugs.launchpad.net
https://bugs.launchpad.net/nova/+bug/1202266
More from Folsom
8.8
CVE-2013-0261
A flaw was found in PackStack
7.6
CVE-2013-0335
OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to gain access to a VM in opportunistic circumstances by using the VNC…
5.5
CVE-2013-0266
A flaw was found in the `puppetlabs-cinder` module, as used in PackStack
5.4
CVE-2012-5571
A flaw was found in OpenStack Keystone
–
CVE-2013-4463
OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file…