CVE-2012-3360

Directory traversal vulnerability in virt/disk/api.py in OpenStack Compute (Nova) Folsom (2012.2) and Essex (2012.1), when used over libvirt-based hypervisors, allows remote authenticated users to write arbitrary files to the disk image via a .. (dot dot) in the path attribute of a file element.

• CWE-22

• http://lists.fedoraproject.org/pipermail/package-announce/2012-July/083984.html
• http://secunia.com/advisories/49763Vendor Advisory
• http://secunia.com/advisories/49802Vendor Advisory
• http://www.securityfocus.com/bid/54277
• http://www.ubuntu.com/usn/USN-1497-1
• https://bugs.launchpad.net/nova/+bug/1015531
• https://github.com/openstack/nova/commit/2427d4a99bed35baefd8f17ba422cb7aae8dcca7
• https://github.com/openstack/nova/commit/b0feaffdb2b1c51182b8dce41b367f3449af5dd9Exploit, Patch
• https://lists.launchpad.net/openstack/msg14089.html
• http://lists.fedoraproject.org/pipermail/package-announce/2012-July/083984.html
• http://secunia.com/advisories/49763Vendor Advisory
• http://secunia.com/advisories/49802Vendor Advisory
• http://www.securityfocus.com/bid/54277
• http://www.ubuntu.com/usn/USN-1497-1
• https://bugs.launchpad.net/nova/+bug/1015531
• https://github.com/openstack/nova/commit/2427d4a99bed35baefd8f17ba422cb7aae8dcca7
• https://github.com/openstack/nova/commit/b0feaffdb2b1c51182b8dce41b367f3449af5dd9Exploit, Patch
• https://lists.launchpad.net/openstack/msg14089.html

Published

Jul 22, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-3354doku.php in DokuWiki, as used in Fedora 16, 17, and 18, when…
• CVE-2012-3355(1) AlbumTab.py, (2) ArtistTab.py, (3) LinksTab.py, and (4) …
• CVE-2012-3356The remote SVN views functionality (lib/vclib/svn/svn_ra.py)…
• CVE-2012-3357The SVN revision view (lib/vclib/svn/svn_repos.py) in ViewVC…
• CVE-2012-3358Multiple heap-based buffer overflows in the j2k_read_sot fun…
• CVE-2012-3359Luci in Red Hat Conga stores the user's username and passwor…
• CVE-2012-3361virt/disk/api.py in OpenStack Compute (Nova) Folsom (2012.2)…
• CVE-2012-3362Cross-site request forgery (CSRF) vulnerability in eXtplorer…
• CVE-2012-3363Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x …9.1
• CVE-2012-3364Multiple stack-based buffer overflows in the Near Field Comm…
• CVE-2012-3365The SQLite functionality in PHP before 5.3.15 allows remote …
• CVE-2012-3366The Trigger plugin in bcfg2 1.2.x before 1.2.3 allows remote…