CVE-2013-0266: openstack essex Incorrect Default Permissions

Vulnerability summary

CVE-2013-0266 is a medium (CVSS 5.5) Incorrect Default Permissions vulnerability in openstack essex. EPSS estimates a 0.27% chance of exploitation in the next 30 days, higher than 17.8% of scored vulnerabilities.

Timeline

1. 08-03-2013
   PublishedVulnerability first disclosed.
2. 30-04-2026
   Last modifiedVulnerability information updated.

Description

A flaw was found in the `puppetlabs-cinder` module, as used in PackStack. This vulnerability is due to incorrect file permissions, specifically world-readable permissions, on the `cinder.conf` and `api-paste.ini` configuration files. A local user can exploit this by reading these files, which leads to the disclosure of OpenStack administrative passwords. This information disclosure could allow unauthorized access to sensitive OpenStack resources.

• CWE-276Incorrect Default PermissionsDuring installation, installed file permissions are set to allow anyone to modify those files.
• CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.