CVE-2013-2256
Last modified
CVE-2013-2256 is a vulnerability of currently unknown severity. OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-2 does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to obtain sensitive information (flavor properties), boot arbitrary flavors, and possibly have other unspecified impacts by guessing the flavor id.. EPSS estimates a 1.83% chance of exploitation in the next 30 days.
Description
OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-2 does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to obtain sensitive information (flavor properties), boot arbitrary flavors, and possibly have other unspecified impacts by guessing the flavor id.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Openstack | Nova | >= 2013.1, < 2013.1.3 | — |
| Openstack | Nova | 2013.2 | Milestone1 |
References
- http://rhn.redhat.com/errata/RHSA-2013-1199.htmlThird Party Advisory
- http://seclists.org/oss-sec/2013/q3/281Mailing List, Patch, Third Party Advisory
- https://bugs.launchpad.net/nova/+bug/1194093Exploit, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2013-1199.htmlThird Party Advisory
- http://seclists.org/oss-sec/2013/q3/281Mailing List, Patch, Third Party Advisory
- https://bugs.launchpad.net/nova/+bug/1194093Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2013-2256?
How severe is CVE-2013-2256?
How do I fix CVE-2013-2256?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2013
- CVE-2013-2249mod_session_dbd.c in the mod_session_dbd module in the Apach…
- CVE-2013-2250Apache Open For Business Project (aka OFBiz) 10.04.01 throug…
- CVE-2013-2251Apache Struts 2.0.0 through 2.3.15 allows remote attackers t…9.8
- CVE-2013-2252Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2013-2254The deepGetOrCreateNode function in impl/operations/Abstract…
- CVE-2013-2255HTTPSConnections in OpenStack Keystone 2013, OpenStack Compu…5.9
- CVE-2013-2257Cryptocat before 2.0.42 has Group Chat ECC Private Key Gener…7.5
- CVE-2013-2258Cryptocat before 2.0.22 has Nickname User Impersonation5.3
- CVE-2013-2259Cryptocat before 2.0.22 has Arbitrary Code Execution on Fire…9.8
- CVE-2013-2260Cryptocat before 2.0.22: Cryptocat.random() Function Array K…9.8
- CVE-2013-2261Cryptocat before 2.0.22 Chrome Extension 'img/keygen.gif' ha…7.5
- CVE-2013-2262Cryptocat strophe.js before 2.0.22 has information disclosur…7.5
Are you affected by CVE-2013-2256?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST