3.5

CVE-2013-1840: openstack glance

CVSS: 3.5v2.0LowModified
AliasesGHSA-c8w9-83vg-r8vvPYSEC-2013-46RHSA-2013:0707
Published 22-03-2013Last modified 06-08-2024
Open JSON

Vulnerability summary

CVE-2013-1840 is a low (CVSS 3.5) vulnerability in openstack glance. EPSS estimates a 1.37% chance of exploitation in the next 30 days, higher than 71.4% of scored vulnerabilities.

Overall risk
14/100
0100
Low · default modelHow is this calculated?
CVSS score
3.5/10
010
Low · v2.0 (NVD)
EPSS score
1.37%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 22-03-2013
    PublishedVulnerability first disclosed.
  2. 06-08-2024
    Last modifiedVulnerability information updated.

Description

The v1 API in OpenStack Glance Essex (2012.1), Folsom (2012.2), and Grizzly, when using the single-tenant Swift or S3 store, reports the location field, which allows remote authenticated users to obtain the operator's backend credentials via a request for a cached image.

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

Probability

1.37%

Chance of exploitation in the next 30 days

Percentile

71%

Versus all other CVEs

30-day change

0.00 pp

From 1.37% on 18-09-2026

18-09-202618-10-2026
EPSS score
1.37%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Redhat3 products
  • openstack-glance< 0:2012.2.3-8.el6ost
  • openstack-glance-doc< 0:2012.2.3-8.el6ost
  • python-glance< 0:2012.2.3-8.el6ost
Debian1 product
  • glance< 2012.1.1-5
Openstack1 product
PyPI1 product
  • glance< 11.0.0a0 | ≤ v1

4 vendors · 6 products

References

32 links
Show all 32 references