Unscored severity · published Oct 26, 2015
CVE-2015-5286
OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of…
–
CVSS
2.4%
EPSS
No
On KEV
Description
OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IR
Image Registry And Delivery Service (glance) · Openstack
through 2014.2.3; 2015.1.0; 2015.1.1 · source: NVD
Affected product
IR
Image Registry And Delivery Service (glance)
Openstack
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-5286
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-5286
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2015-1897.html
www.securityfocus.com
http://www.securityfocus.com/bid/76943
bugs.launchpad.net
https://bugs.launchpad.net/bugs/1498163
Vendor Advisory
https://security.openstack.org/ossa/OSSA-2015-020.html
More from Image Registry And Delivery Service (glance)
4.3
CVE-2016-0757
OpenStack Image Service (Glance) before 2015.1.3 (kilo) and 11.0.x before 11.0.2 (liberty), when show_multiple_locations is enabled, allow remote authenticated users to change…
–
CVE-2015-5251
OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allow remote authenticated users to change the status of their images and bypass access…
–
CVE-2015-1881
OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of…
–
CVE-2014-9684
OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of…
–
CVE-2014-9623
OpenStack Glance 2014.2.x through 2014.2.1, 2014.1.3, and earlier allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by…