Design/Logic Flaw

2014-05-1419:55:00

PRIOn knowledge base

www.prio-n.com

7.5 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

48.1%

JSON

The Identity v3 API in OpenStack Dashboard (Horizon) before 2013.2 does not require the current password when changing passwords for user accounts, which makes it easier for remote attackers to change a user password by leveraging the authentication token for that user.

CPENameOperatorVersion
horizonge2013.1
horizonlt2013.2

CPE	Name	Operator	Version
	horizon	ge	2013.1
	horizon	lt	2013.2

References

lists.openstack.org/pipermail/openstack/2013-November/003299.html

bugs.launchpad.net/horizon/+bug/1237989