CVE-2013-2256 OpenStack Compute (Nova) allows remote authenticated users to obtain sensitive information

What is CVE-2013-2256?

CVE-2013-2256 is a medium-severity missing authorization vulnerability in n/a, published on 16 Sep 2013. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-2 does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to obtain sensitive information (flavor properties), boot arbitrary flavors, and possibly have other unspecified impacts by guessing the flavor id.

Weakness: CWE-264

Which versions are affected by CVE-2013-2256?

3 open source packages ship an affected version, including nova. It affects 1 product.

Products include Openstack Nova.

How do I fix CVE-2013-2256?

Upgrade nova to 2013.1.3 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2013-2256 being exploited?

There is no known exploitation of CVE-2013-2256 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2017-7214 OpenStack Nova logs sensitive context from notification exceptions Critical 9.8
• CVE-2017-17051 OpenStack Nova DoS by rebuilding the same instance with a new image multiple times High 8.6
• CVE-2020-17376 OpenStack Nova Live migration fails to update persistent domain XML High 8.3
• CVE-2017-18191 OpenStack Nova Denial of service attack on the compute host High 7.5
• CVE-2015-3280 OpenStack Compute (nova) allows remote authenticated users to cause a denial of service Medium 6.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2013-2256, GHSA-5mj6-643f-2g85, PYSEC-2026-866.