CVE-2013-1840mediumCWE-201

CVE-2013-1840: medium-severity vulnerability in Red Hat OpenStack Folsom for RHEL 6

Openstack glance: swift: s3: openstack glance: information disclosure of backend credentials via cached image request

Published · Updated

Follow this CVE+ Monitor Red Hat OpenStack Platform+ Monitor OpenStack Folsom

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 1.7%
A flaw was found in OpenStack Glance. Remote authenticated users can exploit this vulnerability by requesting a cached image when the single-tenant Swift or S3 store is in use. This action causes the system to report the location field, which can lead to the disclosure of the operator's backend credentials.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
Red Hat · OpenStack Folsom for RHEL 6Red Hat · Red Hat OpenStack Platform 16.2Red Hat · Red Hat OpenStack Platform 17.1Red Hat · Red Hat OpenStack Platform 18.0
Related CVEs — Red Hat OpenStack Folsom for RHEL 6

In the same product, most dangerous first.

CVE-2013-0270MEDIUMKeystone: openstack keystone: denial of service via large http request with long tenant nameEPSS 3.2%CVE-2013-0335HIGHOpenstack nova: vnc proxy can connect to the wrong vmEPSS 2.1%CVE-2012-5571MEDIUMOpenstack keystone: openstack keystone: authorization bypass via improper ec2 token handlingEPSS 2.1%CVE-2024-1394HIGHGolang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloadsEPSS 1.5%CVE-2012-5625MEDIUMOpenstack nova: information leak in libvirt lvm-backed instancesEPSS 1.4%CVE-2023-3637MEDIUMOpenstack-neutron: unrestricted creation of security groups (fix for cve-2022-3277)EPSS 1.3%