CVE-2013-2296

MediumCVSS 5.5/10Last modified Jun 16, 2026

Description

Walrus in Eucalyptus before 3.2.2 does not verify authorization for the GetBucketLoggingStatus, SetBucketLoggingStatus, and SetBucketVersioningStatus bucket operations, which allows remote authenticated users to bypass intended restrictions on (1) modifying the logging setting, (2) modifying the versioning setting, or (3) accessing activity logs via a request.

Metrics

CVSS 2.0 5.5/10AV:N/AC:L/Au:S/C:P/I:P/A:N

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.eucalyptus.com/resources/security/advisories/esa-10Vendor Advisory
https://eucalyptus.atlassian.net/browse/EUCA-3074Vendor Advisory
http://www.eucalyptus.com/resources/security/advisories/esa-10Vendor Advisory
https://eucalyptus.atlassian.net/browse/EUCA-3074Vendor Advisory

Timeline

Published: Sep 17, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-22976.9Eucalyptus EuStore sets a blank root password in the default configuration of EMI 3868652036, EMI 0400376721, EMI 2425352071, and EMI 134711 CVE-2013-22989.3Multiple stack-based buffer overflows in the XML parser in BOINC 7.x allow attackers to have unspecified impact via a crafted XML file, rela CVE-2013-22993.5Cross-site scripting (XSS) vulnerability in Advantech WebAccess (formerly BroadWin WebAccess) before 7.1 2013.05.30 allows remote authentica CVE-2013-23005.0The FlickWnn (aka OpenWnn/Flick support) application 2.02 and earlier for Android uses weak permissions for unspecified files, which allows CVE-2013-23014.3The OMRON OpenWnn application before 1.3.6 for Android uses weak permissions for unspecified files, which allows attackers to obtain sensiti CVE-2013-23021.9TransWARE Active! mail 6, when an external public interface is used, allows local users to obtain sensitive information belonging to arbitra CVE-2013-23035.0Sleipnir 4.0.0.4000 and earlier on Windows allows remote attackers to spoof the SSL lock icon and address-bar colors via unspecified vectors CVE-2013-23045.8The Sleipnir Mobile application 2.8.0 and earlier and Sleipnir Mobile Black Edition application 2.8.0 and earlier for Android allow remote a CVE-2013-23056.8Cross-site request forgery (CSRF) vulnerability in Cybozu Office before 8.1.6 and 9.x before 9.3.0, Cybozu Dezie before 8.0.7, and Cybozu Ma CVE-2013-23065.8The jigbrowser+ application before 1.6.4 for Android does not properly open windows, which allows remote attackers to spoof the address bar CVE-2013-23075.8The Yahoo! Browser application before 1.4.3 for Android allows remote attackers to spoof the address bar via a crafted web site.CVE-2013-23084.0The (1) OWA Helper and (2) OSG Lite programs in SoftBank Online Service Gate allow remote authenticated users to discover their own password