CVE-2015-0259

MediumCVSS 5.1/10Last modified Jun 17, 2026

Description

OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the authentication of users for access to consoles via a crafted webpage.

Metrics

CVSS 2.0 5.1/10AV:N/AC:H/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-345

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.openstack.org/pipermail/openstack-announce/2015-March/000341.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-0790.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-0843.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-0844.htmlThird Party Advisory
https://bugs.launchpad.net/nova/+bug/1409142Third Party Advisory
http://lists.openstack.org/pipermail/openstack-announce/2015-March/000341.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-0790.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-0843.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-0844.htmlThird Party Advisory
https://bugs.launchpad.net/nova/+bug/1409142Third Party Advisory

Timeline

Published: Apr 1, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-02604.0RhodeCode before 2.2.7 and Kallithea 0.1 allows remote authenticated users to obtain API keys and other sensitive information via the get_re CVE-2015-02617.5Integer signedness error in the mobility_opt_print function in the IPv6 mobility printer in tcpdump before 4.7.2 allows remote attackers to CVE-2015-02635.0XML external entity (XXE) vulnerability in the XML converter setup in converter/jaxp/XmlConverter.java in Apache Camel before 2.13.4 and 2.1 CVE-2015-02645.0Multiple XML external entity (XXE) vulnerabilities in builder/xml/XPathBuilder.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 a CVE-2015-02656.1Cross-site scripting (XSS) vulnerability in the Policy Admin Tool in Apache Ranger before 0.5.0 allows remote attackers to inject arbitrary CVE-2015-02667.1The Policy Admin Tool in Apache Ranger before 0.5.0 allows remote authenticated users to bypass intended access restrictions via direct acce CVE-2015-02673.6The Red Hat module-setup.sh script for kexec-tools, as distributed in the kexec-tools before 2.0.7-19 packages in Red Hat Enterprise Linux, CVE-2015-02684.9The vgic_v2_to_sgi function in arch/arm/vgic-v2.c in Xen 4.5.x, when running on ARM hardware with general interrupt controller (GIC) version CVE-2015-02694.3Directory traversal vulnerability in Contao before 3.2.19, and 3.4.x before 3.4.4 allows remote authenticated "back end" users to view files CVE-2015-02709.8Zend Framework before 2.2.10 and 2.3.x before 2.3.5 has Potential SQL injection in PostgreSQL Zend\Db adapter.CVE-2015-02714.0The log-viewing function in the Red Hat redhat-access-plugin before 6.0.3 for OpenStack Dashboard (horizon) allows remote attackers to read CVE-2015-02725.0GNOME NetworkManager allows remote attackers to cause a denial of service (IPv6 traffic disruption) via a crafted MTU value in an IPv6 Route