CVE-2014-9493

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.2.2 and 2014.1.4 allows remote authenticated users to read or delete arbitrary files via a full pathname in a file: URL in the image location property.

Metrics

CVSS 2.0 5.5/10AV:N/AC:L/Au:S/C:P/I:N/A:P

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.openstack.org/pipermail/openstack-announce/2014-December/000317.htmlPatch, Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-0246.htmlThird Party Advisory
http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.htmlThird Party Advisory
http://www.securityfocus.com/bid/71688Third Party Advisory, VDB Entry
https://bugs.launchpad.net/glance/+bug/1400966Issue Tracking, Third Party Advisory
https://security.openstack.org/ossa/OSSA-2014-041.htmlVendor Advisory
http://lists.openstack.org/pipermail/openstack-announce/2014-December/000317.htmlPatch, Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-0246.htmlThird Party Advisory
http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.htmlThird Party Advisory
http://www.securityfocus.com/bid/71688Third Party Advisory, VDB Entry
https://bugs.launchpad.net/glance/+bug/1400966Issue Tracking, Third Party Advisory
https://security.openstack.org/ossa/OSSA-2014-041.htmlVendor Advisory

Timeline

Published: Jan 7, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-94945.0RabbitMQ before 3.4.0 allows remote attackers to bypass the loopback_users restriction via a crafted X-Forwareded-For header.CVE-2014-94958.8Heap-based buffer overflow in the png_combine_row function in libpng before 1.5.21 and 1.6.x before 1.6.16, when running on 64-bit systems, CVE-2014-94962.1The sd2_parse_rsrc_fork function in sd2.c in libsndfile allows attackers to have unspecified impact via vectors related to a (1) map offset CVE-2014-94977.5Buffer overflow in mpg123 before 1.18.0.CVE-2014-94983.5Cross-site scripting (XSS) vulnerability in the Webform Invitation module 7.x-1.x before 7.x-1.3 and 7.x-2.x before 7.x-2.4 for Drupal allow CVE-2014-94993.5Cross-site scripting (XSS) vulnerability in the Godwin's Law module before 7.x-1.1 for Drupal, when using the dblog module, allows remote au CVE-2014-95004.3Cross-site scripting (XSS) vulnerability in the Moip module 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to inject arbitrary we CVE-2014-95013.5Cross-site scripting (XSS) vulnerability in the Poll Chart Block module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users CVE-2014-95028.8Multiple cross-site request forgery (CSRF) vulnerabilities in unspecified sub modules in the Open Atrium module 7.x-2.x before 7.x-2.26 for CVE-2014-95036.5The Discussions sub module in the Open Atrium module 7.x-2.x before 7.x-2.26 for Drupal allows remote authenticated users with "access conte CVE-2014-95047.5The OG Subgroups module, when used with the Open Atrium module 7.x-2.x before 7.x-2.26 for Drupal, allows remote attackers to access child g CVE-2014-95053.5Cross-site scripting (XSS) vulnerability in the School Administration module 7.x-1.x before 7.x-1.8 for Drupal allows remote authenticated u