CVE-2015-7713

OpenStack Compute (Nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) do not properly apply security group changes, which allows remote attackers to bypass intended restriction by leveraging an instance that was running when the change was made.

• CWE-254

• http://rhn.redhat.com/errata/RHSA-2015-2684.htmlThird Party Advisory
• http://www.securityfocus.com/bid/76960Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2015:2673Third Party Advisory
• https://bugs.launchpad.net/nova/+bug/1491307Third Party Advisory
• https://bugs.launchpad.net/nova/+bug/1492961Third Party Advisory
• https://security.openstack.org/ossa/OSSA-2015-021.htmlVendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-2684.htmlThird Party Advisory
• http://www.securityfocus.com/bid/76960Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2015:2673Third Party Advisory
• https://bugs.launchpad.net/nova/+bug/1491307Third Party Advisory
• https://bugs.launchpad.net/nova/+bug/1492961Third Party Advisory
• https://security.openstack.org/ossa/OSSA-2015-021.htmlVendor Advisory

Published

Oct 29, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-7706Multiple cross-site scripting (XSS) vulnerabilities in Secur…
• CVE-2015-7707Ignite Realtime Openfire 3.10.2 allows remote authenticated …
• CVE-2015-7708Cross-site scripting (XSS) vulnerability in 4images 1.7.11 a…
• CVE-2015-7709The arkeiad daemon in the Arkeia Backup Agent in Western Dig…
• CVE-2015-7711Cross-site scripting (XSS) vulnerability in popuphelp.php in…
• CVE-2015-7712Multiple eval injection vulnerabilities in mods/_standard/gr…
• CVE-2015-7714Multiple SQL injection vulnerabilities in the Realtyna RPL (…7.2
• CVE-2015-7715Cross-site request forgery (CSRF) vulnerability in the Realt…8.8
• CVE-2015-7716libstagefright in Android 5.x before 5.1.1 LMY48T allows rem…
• CVE-2015-7717mediaserver in Android 5.x before 5.1.1 LMY48T and 6.0 befor…
• CVE-2015-7718mediaserver in Android 5.x before 5.1.1 LMY48T and 6.0 befor…
• CVE-2015-7723AMD fglrx-driver before 15.7 allows local users to gain priv…