PT-2015-6817 · Openstack+1 · Openstack Image Service+1

Hemanth Makkapati · Publicado 2015-09-22 · Atualizado 2023-02-13 · CVE-2015-5251

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenStack Image Service (Glance) versions prior to 2014.2.4 (juno) OpenStack Image Service (Glance) versions 2015.1.x prior to 2015.1.2 (kilo)

Description The issue allows remote authenticated users to bypass access restrictions and change the status of their images. This is achieved by using the HTTP x-image-meta-status header to images/*.

Recommendations For versions prior to 2014.2.4 (juno), update to version 2014.2.4 or later. For versions 2015.1.x prior to 2015.1.2 (kilo), update to version 2015.1.2 or later.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-264

CWE-863

Identificadores relacionados

CVE-2015-5251

GHSA-Q748-MCWG-XMQV

RHSA-2015:1897

SUSE-SU-2016:0101-1

USN-3446-1

Produtos afetados

Openstack Image Service

Ubuntu

Referências · 28

• https://osv.dev/vulnerability/UBUNTU-CVE-2015-5251 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-5251 · Nota de Segurança
• https://security.openstack.org/ossa/OSSA-2015-019.html · Aviso do Fabricante
• https://rhn.redhat.com/errata/RHSA-2015-1897.html · Nota
• https://access.redhat.com/errata/RHSA-2015:1897 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-5251 · Aviso do Fabricante
• https://suse.com/support/update/announcement/2016/suse-su-20160101-1 · Nota
• https://opendev.org/openstack/glance · Nota
• https://ubuntu.com/security/CVE-2015-5251 · Aviso do Fabricante
• https://bugs.launchpad.net/bugs/1482371 · Nota
• https://access.redhat.com/security/cve/CVE-2015-5251 · Nota
• https://osv.dev/vulnerability/GHSA-q748-mcwg-xmqv · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-SU-2016:0101-1 · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2015-1897.html · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2015-5251 · Nota