Unscored severity · published Jan 7, 2015
CVE-2014-9493
The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.2.2 and 2014.1.4 allows remote authenticated users to read or delete arbitrary files via a full…
–
CVSS
2.8%
EPSS
No
On KEV
Description
The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.2.2 and 2014.1.4 allows remote authenticated users to read or delete arbitrary files via a full pathname in a file: URL in the image location property.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.8% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IR
Image Registry And Delivery Service (glance) · Openstack
2014.1 before 2014.1.4; 2014.2 before 2014.2.2 · source: NVD
OP
Openstack · Redhat
4.0; 5.0 · source: NVD
Affected product
IR
Image Registry And Delivery Service (glance)
Openstack
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-9493
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-9493
Patch
http://lists.openstack.org/pipermail/openstack-announce/2014-December/000317.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-0246.html
Third Party Advisory
http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
Third Party Advisory
http://www.securityfocus.com/bid/71688
Issue Tracking
https://bugs.launchpad.net/glance/+bug/1400966
Vendor Advisory
https://security.openstack.org/ossa/OSSA-2014-041.html
More from Image Registry And Delivery Service (glance)
4.3
CVE-2016-0757
OpenStack Image Service (Glance) before 2015.1.3 (kilo) and 11.0.x before 11.0.2 (liberty), when show_multiple_locations is enabled, allow remote authenticated users to change…
–
CVE-2015-5286
OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of…
–
CVE-2015-5251
OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allow remote authenticated users to change the status of their images and bypass access…
–
CVE-2015-1881
OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of…
–
CVE-2014-9684
OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of…