CVE-2024-32498

An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected.

• CWE-552

• http://www.openwall.com/lists/oss-security/2024/07/02/2
• https://launchpad.net/bugs/2059809Issue Tracking, Patch
• https://security.openstack.org/ossa/OSSA-2024-001.html
• https://www.openwall.com/lists/oss-security/2024/07/02/2Mailing List, Patch
• http://www.openwall.com/lists/oss-security/2024/07/02/2
• https://launchpad.net/bugs/2059809Issue Tracking, Patch
• https://lists.debian.org/debian-lts-announce/2024/09/msg00016.html
• https://lists.debian.org/debian-lts-announce/2024/09/msg00017.html
• https://www.openwall.com/lists/oss-security/2024/07/02/2Mailing List, Patch

Published

Jul 5, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-32488In Foxit PDF Reader and Editor before 2024.1, Local Privileg…7.8
• CVE-2024-32489TCPDF before 6.7.4 mishandles calls that use HTML syntax.6.1
• CVE-2024-3249The Zita Elementor Site Library plugin for WordPress is vuln…4.3
• CVE-2024-32491An issue was discovered in Znuny and Znuny LTS 6.0.31 throug…9.8
• CVE-2024-32492An issue was discovered in Znuny 7.0.1 through 7.0.16 where …7.1
• CVE-2024-32493An issue was discovered in Znuny LTS 6.5.1 through 6.5.7 and…8.8
• CVE-2024-32499Newforma Project Center Server through 2023.3.0.32259 allows…9.8
• CVE-2024-3250It was discovered that Canonical's Pebble service manager re…6.5
• CVE-2024-32501A SQL Injection vulnerability exists in the updateServiceHos…9.8
• CVE-2024-32502An issue was discovered in Samsung Mobile Processor and Wear…8.4
• CVE-2024-32503An issue was discovered in Samsung Mobile Processor and Wear…7.8
• CVE-2024-32504An issue was discovered in Samsung Mobile Processor and Wear…7.8