PT-2015-6817 · Openstack+1 · Openstack Image Service+1

Hemanth Makkapati · CVE-2015-5251 · Published 2015-09-22 · Updated 2026-07-06

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenStack Image Service (Glance) versions prior to 2014.2.4 (juno) OpenStack Image Service (Glance) versions 2015.1.x prior to 2015.1.2 (kilo)

Description The issue allows remote authenticated users to bypass access restrictions and change the status of their images. This is achieved by using the HTTP x-image-meta-status header to images/*.

Recommendations For versions prior to 2014.2.4 (juno), update to version 2014.2.4 or later. For versions 2015.1.x prior to 2015.1.2 (kilo), update to version 2015.1.2 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-264

CWE-863

Related Identifiers

CVE-2015-5251

GHSA-Q748-MCWG-XMQV

PYSEC-2026-816

RHSA-2015:1897

SUSE-SU-2016:0101-1

USN-3446-1

Affected Products

Openstack Image Service

Ubuntu

References · 31

• https://ubuntu.com/security/CVE-2015-5251 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-5286 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-5251 · Security Note
• https://ubuntu.com/security/CVE-2016-0757 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1897.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q748-mcwg-xmqv · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:0101-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3446-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-5251 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-5251 · Vendor Advisory
• https://security.openstack.org/ossa/OSSA-2015-019.html · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3446-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-5251 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-5251 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-816 · Vendor Advisory