Unscored severity · published Oct 8, 2014
CVE-2014-3641
The (1) GlusterFS and (2) Linux Smbfs drivers in OpenStack Cinder before 2014.1.3 allows remote authenticated users to obtain file data from the Cinder-volume host by cloning and…
–
CVSS
1.9%
EPSS
No
On KEV
Description
The (1) GlusterFS and (2) Linux Smbfs drivers in OpenStack Cinder before 2014.1.3 allows remote authenticated users to obtain file data from the Cinder-volume host by cloning and attaching a volume with a crafted qcow2 header.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CI
Cinder · Openstack
through 2014.1.2; 2014.1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3641
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-3641
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2014-1787.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2014-1788.html
seclists.org
http://seclists.org/oss-sec/2014/q4/78
www.securityfocus.com
http://www.securityfocus.com/bid/70221
www.ubuntu.com
http://www.ubuntu.com/usn/USN-2405-1
bugs.launchpad.net
https://bugs.launchpad.net/cinder/+bug/1350504
More from Cinder
7.5
CVE-2017-15139
A vulnerability was found in openstack-cinder releases up to and including Queens, allowing newly created volumes in certain storage volume configurations to contain previous data
7.5
CVE-2015-5162
The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0 does not properly limit qemu-img calls,…
6.5
CVE-2024-32498
An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3
5.7
CVE-2022-47951
An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x…
4.3
CVE-2026-93856
In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API