CVE-2013-4428

LowCVSS 3.5/10Last modified Jun 16, 2026

Description

OpenStack Image Registry and Delivery Service (Glance) Folsom, Grizzly before 2013.1.4, and Havana before 2013.2, when the download_image policy is configured, does not properly restrict access to cached images, which allows remote authenticated users to read otherwise restricted images via an image UUID.

Metrics

CVSS 2.0 3.5/10AV:N/AC:M/Au:S/C:P/I:N/A:N

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://rhn.redhat.com/errata/RHSA-2013-1525.htmlThird Party Advisory
http://www.openwall.com/lists/oss-security/2013/10/15/8Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2013/10/16/9Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/63159Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-2003-1Third Party Advisory
https://bugs.launchpad.net/glance/+bug/1235226Exploit, Third Party Advisory
https://bugs.launchpad.net/glance/+bug/1235378Exploit, Third Party Advisory
https://launchpad.net/glance/+milestone/2013.1.4Patch, Third Party Advisory
https://launchpad.net/glance/+milestone/2013.2Patch, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-1525.htmlThird Party Advisory
http://www.openwall.com/lists/oss-security/2013/10/15/8Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2013/10/16/9Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/63159Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-2003-1Third Party Advisory
https://bugs.launchpad.net/glance/+bug/1235226Exploit, Third Party Advisory
https://bugs.launchpad.net/glance/+bug/1235378Exploit, Third Party Advisory
https://launchpad.net/glance/+milestone/2013.1.4Patch, Third Party Advisory
https://launchpad.net/glance/+milestone/2013.2Patch, Third Party Advisory

Timeline

Published: Oct 27, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-44294.0Mahara before 1.5.12, 1.6.x before 1.6.7, and 1.7.x before 1.7.3 does not properly restrict access to artefacts, which allows remote authent CVE-2013-44304.3Cross-site scripting (XSS) vulnerability in Mahara before 1.5.12, 1.6.x before 1.6.7, and 1.7.x before 1.7.3 allows remote attackers to inje CVE-2013-44315.5Mahara before 1.5.12, 1.6.x before 1.6.7, and 1.7.x before 1.7.3 does not properly prevent access to blocks, which allows remote authenticat CVE-2013-44324.0Mahara before 1.5.13, 1.6.x before 1.6.8, and 1.7.x before 1.7.4 does not properly restrict access to folders, which allows remote authentic CVE-2013-44334.3Cross-site scripting (XSS) vulnerability in XHProf before 0.9.4 allows remote attackers to inject arbitrary web script or HTML via the run p CVE-2013-44345.0Dropbear SSH Server before 2013.59 generates error messages for a failed logon attempt with different time delays depending on whether the u CVE-2013-44356.0Salt (aka SaltStack) 0.15.0 through 0.17.0 allows remote authenticated users who are using external authentication or client ACL to execute CVE-2013-44369.3The default configuration for salt-ssh in Salt (aka SaltStack) 0.17.0 does not validate the SSH host key of requests, which allows remote at CVE-2013-443710.0Unspecified vulnerability in salt-ssh in Salt (aka SaltStack) 0.17.0 has unspecified impact and vectors related to "insecure Usage of /tmp."CVE-2013-44387.5Salt (aka SaltStack) before 0.17.1 allows remote attackers to execute arbitrary YAML code via unspecified vectors. NOTE: the vendor states CVE-2013-44394.9Salt (aka SaltStack) before 0.15.0 through 0.17.0 allows remote authenticated minions to impersonate arbitrary minions via a crafted minion CVE-2013-44405.0Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependent attackers to guess