NVD

Id
41483  
Name
CVE-2013-6426  
Description
The cloudformation-compatible API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 does not properly enforce policy rules, which allows local in-instance users to bypass intended access restrictions and (1) create a stack via the CreateStack method or (2) update a stack via the UpdateStack method.  
Reject
 
CVSS Version
2  
CVSS Score
4  
Severity
Medium  
CVSS Base Score
4  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8  
CVSS Vector
(AV:N/AC:L/Au:S/C:N/I:P/A:N)  
Pub Date
2017-01-18  
Published
2013-12-14  
Modified Date
2014-03-05  
Seq
2013-6426  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
209615 41483 CVE-2013-6426 RHSA-2014:0090  View
209616 41483 CVE-2013-6426 [oss-security] 20131211 [OSSA 2013-034] Heat CFN policy rules not all enforced (CVE-2013-6426)  View
209617 41483 CVE-2013-6426 64243  View
209618 41483 CVE-2013-6426 keystone-cve20136426-sec-bypass(89658)  View
209619 41483 CVE-2013-6426 https://bugs.launchpad.net/heat/+bug/1256049  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
23972 JVNDB-2013-005547 OpenStack Orchestration API の cloudformation-compatible API におけるアクセス制限を回避される脆弱性 OpenStack Orchestration API (Heat) の cloudformation-compatible API は、ポリシールールを適切に適用しないため、アクセス制限を回避され、(1) スタックを作成される、または (2) スタックを更新される脆弱性が存在します。 CVE-2013-6426 66368 CVE-2013-6426 41483 4 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-005547.html 2013-12-14 2015-08-07 View