CVE-2015-7713

MediumCVSS 5.0/10Last modified Jun 17, 2026

Description

OpenStack Compute (Nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) do not properly apply security group changes, which allows remote attackers to bypass intended restriction by leveraging an instance that was running when the change was made.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-254

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://rhn.redhat.com/errata/RHSA-2015-2684.htmlThird Party Advisory
http://www.securityfocus.com/bid/76960Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2015:2673Third Party Advisory
https://bugs.launchpad.net/nova/+bug/1491307Third Party Advisory
https://bugs.launchpad.net/nova/+bug/1492961Third Party Advisory
https://security.openstack.org/ossa/OSSA-2015-021.htmlVendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-2684.htmlThird Party Advisory
http://www.securityfocus.com/bid/76960Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2015:2673Third Party Advisory
https://bugs.launchpad.net/nova/+bug/1491307Third Party Advisory
https://bugs.launchpad.net/nova/+bug/1492961Third Party Advisory
https://security.openstack.org/ossa/OSSA-2015-021.htmlVendor Advisory

Timeline

Published: Oct 29, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-77147.2Multiple SQL injection vulnerabilities in the Realtyna RPL (com_rpl) component before 8.9.5 for Joomla! allow remote administrators to execu CVE-2015-77158.8Cross-site request forgery (CSRF) vulnerability in the Realtyna RPL (com_rpl) component before 8.9.5 for Joomla! allows remote attackers to CVE-2015-771610.0libstagefright in Android 5.x before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory cor CVE-2015-77179.3mediaserver in Android 5.x before 5.1.1 LMY48T and 6.0 before 2015-10-01 allows attackers to gain privileges via a crafted application, aka CVE-2015-77185.0mediaserver in Android 5.x before 5.1.1 LMY48T and 6.0 before 2015-10-01 allows attackers to cause a denial of service (process crash) via u CVE-2015-77237.8AMD fglrx-driver before 15.7 allows local users to gain privileges via a symlink attack.CVE-2015-77247.8AMD fglrx-driver before 15.9 allows local users to gain privileges via a symlink attack. NOTE: This vulnerability exists due to an incomple CVE-2015-77256.5Multiple SQL injection vulnerabilities in the Web-based Development Workbench in SAP HANA DB 1.00.091.00.1418659308 allow remote authenticat CVE-2015-77263.5Cross-site scripting (XSS) vulnerability in role deletion in the Web-based Development Workbench in SAP HANA DB 1.00.091.00.1418659308 allow CVE-2015-77276.5Multiple SQL injection vulnerabilities in the Web-based Development Workbench in SAP HANA DB 1.00.73.00.389160 (NewDB100_REL) allow remote a CVE-2015-77283.5Cross-site scripting (XSS) vulnerability in user creation in the Web-based Development Workbench in SAP HANA DB 1.00.73.00.389160 (NewDB100_CVE-2015-77296.5Eval injection in test-net.xsjs in the Web-based Development Workbench in SAP HANA Developer Edition DB 1.00.091.00.1418659308 allows remote