CVE-2014-1948: openstack image_registry_and_delivery_service_\(glance\) Credentials Management Errors

EPSS trend

Probability

0.31%

Chance of exploitation in the next 30 days

Percentile

23%

Versus all other CVEs

30-day change

0.00 pp

From 0.31% on 19-09-2026

19-09-202619-10-2026

EPSS score

0.31%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

References

18 links

bugs.launchpad.net/glance/+bug/1275062X Refsource CONFIRMWEB
secunia.com/advisories/56419Third Party AdvisoryX Refsource SECUNIAAdvisory
rhn.redhat.com/errata/RHSA-2014-0229.htmlVendor AdvisoryX Refsource REDHATWEBAdvisory
www.securityfocus.com/bid/65507VDB EntryX Refsource BIDWEB
www.openwall.com/lists/oss-security/2014/02/12/18Mailing ListX Refsource MLISTWEB
nvd.nist.gov/vuln/detail/CVE-2014-1948Advisory
github.com/openstack/glance/commit/108f0e04ad2ed3dc287f1b71b987a7e9d66072baWEB
github.com/openstack/glance/commit/f6e41e9c0ff3aa9ee57b8c8ed8c789f1aff019bcWEB
github.com/openstack/glancePACKAGE
github.com/pypa/advisory-database/tree/main/vulns/glance/PYSEC-2014-102.yamlWEB

Show all 18 references

Related vulnerabilities

CVE-2013-0212canonicalubuntu_linux+62.99%13y ago24-02-2013 21:00store/swift.py in OpenStack Glance Essex (2012.1), Folsom (2012.2) before 2012.2.3, and Grizzly, when in Swift single tenant mode, logs the Swift endpoint's user name and password in cleartext when the endpoint is misconfigured or unusable, allows remote authenticated users to obtain sensitive information by reading the error messages.CVE-2013-4354debianglance+10.35%12y ago23-11-2013 17:00The API before 2.1 in OpenStack Image Registry and Delivery Service (Glance) makes it easier for local users to inject images into arbitrary tenants by adding the tenant as a member of the image.CVE-2015-1195debianglance+22.79%11y ago21-01-2015 18:00The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote authenticated users to read or delete arbitrary files via a full pathname in a filesystem: URL in the image location property. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9493.CVE-2015-1881openstackimage_registry_and_delivery_service_\(glance\)+12.12%11y ago24-02-2015 15:00OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service (disk consumption) by creating a large number of images using the task v2 API and then deleting them, a different vulnerability than CVE-2014-9684.CVE-2015-5286chainguardopenstack-glance-2025.1+122.40%10y ago26-10-2015 17:00OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623.CVE-2015-5251debianglance+32.05%10y ago26-10-2015 17:00OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allow remote authenticated users to change the status of their images and bypass access restrictions via the HTTP x-image-meta-status header to images/*.

All vulnerabilities inimage_registry_and_delivery_service_\(glance\)

CVE-2014-1948: openstack image_registry_and_delivery_service_\(glance\) Credentials Management Errors

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References