CVE-2015-1195

2015-01-2118:59:56

CWE-22

[email protected]

web.nvd.nist.gov

openstack

glance

v2 api

image registry

delivery service

cve-2015-1195

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

6.3 Medium

AI Score

Confidence

Low

0.007 Low

EPSS

Percentile

80.1%

JSON

The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote authenticated users to read or delete arbitrary files via a full pathname in a filesystem: URL in the image location property. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9493.

Affected configurations

NVD

Node

openstackimage_registry_and_delivery_service_\(glance\)Range2014.1–2014.1.4

openstackimage_registry_and_delivery_service_\(glance\)Range2014.2–2014.2.2

CPENameOperatorVersion
openstack:image_registry_and_delivery_service_\(glance\)openstack image registry and delivery service (glance)lt2014.1.4
openstack:image_registry_and_delivery_service_\(glance\)openstack image registry and delivery service (glance)lt2014.2.2

CPE	Name	Operator	Version
openstack:image_registry_and_delivery_service_\(glance\)	openstack image registry and delivery service (glance)	lt	2014.1.4
openstack:image_registry_and_delivery_service_\(glance\)	openstack image registry and delivery service (glance)	lt	2014.2.2