CVE-2012-0030 Missing authorization in n/a
Authenticated users can bypass tenant isolation in OpenStack Nova by modifying the project_id parameter, allowing unauthorized access to other tenants' resources.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2012-0030?
CVE-2012-0030 is a medium-severity missing authorization vulnerability in n/a, published on 13 Jan 2012. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Nova 2011.3 and Essex, when using the OpenStack API, allows remote authenticated users to bypass access restrictions for tenants of other users via an OSAPI request with a modified project_id URI parameter.
Weakness: CWE-264
Which versions are affected by CVE-2012-0030?
It affects 2 products.
Products include Openstack Essex, Openstack Nova.
How do I fix CVE-2012-0030?
Apply the vendor's patch.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2012-0030 being exploited?
There is no known exploitation of CVE-2012-0030 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2013-0261 Packstack: packstack: arbitrary file overwrite via symlink attack
- CVE-2013-0266 Information disclosure in Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse)
- CVE-2012-4573 OpenStack Glance arbitrary deletion of non-protected images
- CVE-2012-5482 OpenStack Glance arbitrary deletion of non-protected images
- CVE-2012-3360 OpenStack Nova Directory traversal vulnerability
Sources
Also known as DEBIAN-CVE-2012-0030, GHSA-3c45-vg2q-j67q.