CVE-2013-2256

MediumCVSS 6.0/10Last modified Jun 16, 2026

Description

OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-2 does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to obtain sensitive information (flavor properties), boot arbitrary flavors, and possibly have other unspecified impacts by guessing the flavor id.

Metrics

CVSS 2.0 6.0/10AV:N/AC:M/Au:S/C:P/I:P/A:P

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://rhn.redhat.com/errata/RHSA-2013-1199.htmlThird Party Advisory
http://seclists.org/oss-sec/2013/q3/281Mailing List, Patch, Third Party Advisory
https://bugs.launchpad.net/nova/+bug/1194093Exploit, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-1199.htmlThird Party Advisory
http://seclists.org/oss-sec/2013/q3/281Mailing List, Patch, Third Party Advisory
https://bugs.launchpad.net/nova/+bug/1194093Exploit, Third Party Advisory

Timeline

Published: Sep 16, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-22577.5Cryptocat before 2.0.42 has Group Chat ECC Private Key Generation Brute Force Weakness CVE-2013-22585.3Cryptocat before 2.0.22 has Nickname User Impersonation CVE-2013-22599.8Cryptocat before 2.0.22 has Arbitrary Code Execution on Firefox Conversation Overview CVE-2013-22609.8Cryptocat before 2.0.22: Cryptocat.random() Function Array Key has Entropy Weakness CVE-2013-22617.5Cryptocat before 2.0.22 Chrome Extension 'img/keygen.gif' has Information Disclosure CVE-2013-22627.5Cryptocat strophe.js before 2.0.22 has information disclosure CVE-2013-22635.0Unspecified vulnerability in Citrix Access Gateway Standard Edition 5.0.x before 5.0.4.223524 allows remote attackers to access network reso CVE-2013-22645.0The SIP channel driver in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x before 11.2.2; Certified Asterisk 1.8.15 CVE-2013-22667.8libdns in ISC BIND 9.7.x and 9.8.x before 9.8.4-P2, 9.8.5 before 9.8.5b2, 9.9.x before 9.9.2-P2, and 9.9.3 before 9.9.3b2 on UNIX platforms CVE-2013-22677.2PHP Code Injection vulnerability in FUDforum Bulletin Board Software 3.0.4 could allow remote attackers to execute arbitrary code on the sys CVE-2013-22687.5Unspecified vulnerability in the MathML implementation in WebKit in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.CVE-2013-22695.0The Sponsorship Confirmation functionality in Aruba Networks ClearPass 5.x, 6.0.1, and 6.0.2, and Amigopod/ClearPass Guest 3.0 through 3.9.7