CVSS: 4.0EPSS: 0%CPEs: 1EXPL: 1CVE-2013-6426 – Heat: CFN policy rules not all enforced
https://notcve.org/view.php?id=CVE-2013-6426
The cloudformation-compatible API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 does not properly enforce policy rules, which allows local in-instance users to bypass intended access restrictions and (1) create a stack via the CreateStack method or (2) update a stack via the UpdateStack method. El API compatible con CloudFormation en API OpenStack orquestación (Heat) antes de Habana 2013.2.1 y anterior a Icehouse Icehouse-2 no aplica correctamente las reglas de política, lo que permite a los usuarios locales en la instancia evitar las restricciones de acceso establecidas y, (1) crear una pila a través de el método CreateStack o, (2) actualizar una pila a través del método UpdateStack. • http://rhn.redhat.com/errata/RHSA-2014-0090.html http://www.openwall.com/lists/oss-security/2013/12/11/9 http://www.securityfocus.com/bid/64243 https://bugs.launchpad.net/heat/+bug/1256049 https://exchange.xforce.ibmcloud.com/vulnerabilities/89658 https://access.redhat.com/security/cve/CVE-2013-6426 https://bugzilla.redhat.com/show_bug.cgi?id=1039141 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.0EPSS: 0%CPEs: 1EXPL: 1CVE-2013-6428 – Heat: ReST API doesn't respect tenant scoping
https://notcve.org/view.php?id=CVE-2013-6428
The ReST API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 allows remote authenticated users to bypass the tenant scoping restrictions via a modified tenant_id in the request path. La API ReST en API OpenStack Orchestration API (Heat) anterior de a Habana 2013.2.1 y Icehouse anterior a Icehouse-2 permite a usuarios remotos autenticados eludir la restricciones de uso de inquilinos a través de un tenant_id modificado en la ruta de solicitud. • http://rhn.redhat.com/errata/RHSA-2014-0090.html http://seclists.org/oss-sec/2013/q4/479 https://launchpad.net/bugs/1256983 https://access.redhat.com/security/cve/CVE-2013-6428 https://bugzilla.redhat.com/show_bug.cgi?id=1039144 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 2CVE-2009-3642 – HEAT Call Logging 8.01 - SQL Injection
https://notcve.org/view.php?id=CVE-2009-3642
Multiple SQL injection vulnerabilities in the Call Logging feature in FrontRange HEAT 8.01 allow remote attackers to execute arbitrary SQL commands via the (1) username and (2) password parameters. Múltiples vulnerabilidades de inyección SQL en la funcionalidad de Registro de llamadas de FrontRange HEAT v8.01 permite a atacantes remotos ejecutar comandos SQL a través de los parámetros (1) UserName y (2) password. • https://www.exploit-db.com/exploits/9809 http://packetstormsecurity.org/0909-exploits/heat-sql.txt http://secunia.com/advisories/36900 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •