Unscored severity · published Aug 19, 2015
CVE-2015-5163
The import task action in OpenStack Image Service (Glance) 2015.1.x before 2015.1.2 (kilo), when using the V2 API, allows remote authenticated users to read arbitrary files via a…
–
CVSS
1.5%
EPSS
No
On KEV
Description
The import task action in OpenStack Image Service (Glance) 2015.1.x before 2015.1.2 (kilo), when using the V2 API, allows remote authenticated users to read arbitrary files via a crafted backing file for a qcow2 image.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GL
Glance · Openstack
2015.1.0; 2015.1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-5163
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-5163
lists.openstack.org
http://lists.openstack.org/pipermail/openstack-announce/2015-August/000527.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2015-1639.html
www.securityfocus.com
http://www.securityfocus.com/bid/76346
bugs.launchpad.net
https://bugs.launchpad.net/glance/+bug/1471912
More from Glance
7.5
CVE-2015-5162
The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0 does not properly limit qemu-img calls,…
7.0
CVE-2026-71198
In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image
6.5
CVE-2024-32498
An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3
6.5
CVE-2016-8611
A vulnerability was found in Openstack Glance
5.8
CVE-2017-7200
An SSRF issue was discovered in OpenStack Glance before Newton