CVE-2013-6426
Heat: CFN policy rules not all enforced
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
The cloudformation-compatible API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 does not properly enforce policy rules, which allows local in-instance users to bypass intended access restrictions and (1) create a stack via the CreateStack method or (2) update a stack via the UpdateStack method.
El API compatible con CloudFormation en API OpenStack orquestación (Heat) antes de Habana 2013.2.1 y anterior a Icehouse Icehouse-2 no aplica correctamente las reglas de política, lo que permite a los usuarios locales en la instancia evitar las restricciones de acceso establecidas y, (1) crear una pila a través de el método CreateStack o, (2) actualizar una pila a través del método UpdateStack.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2013-11-04 CVE Reserved
- 2013-12-14 CVE Published
- 2024-08-06 CVE Updated
- 2024-08-06 First Exploit
- 2024-11-03 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-264: Permissions, Privileges, and Access Controls
CAPEC
References (7)
URL | Tag | Source |
---|---|---|
http://www.openwall.com/lists/oss-security/2013/12/11/9 | Mailing List | |
http://www.securityfocus.com/bid/64243 | Vdb Entry | |
https://exchange.xforce.ibmcloud.com/vulnerabilities/89658 | Vdb Entry |
URL | Date | SRC |
---|---|---|
https://bugs.launchpad.net/heat/+bug/1256049 | 2024-08-06 |
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
http://rhn.redhat.com/errata/RHSA-2014-0090.html | 2017-08-29 | |
https://access.redhat.com/security/cve/CVE-2013-6426 | 2014-01-22 | |
https://bugzilla.redhat.com/show_bug.cgi?id=1039141 | 2014-01-22 |