CVE-2013-4471 Auth bypass in n/a
Remote attackers can change user passwords without the current password by leveraging an authentication token, leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-4471?
CVE-2013-4471 is a medium-severity authentication bypass vulnerability in n/a, published on 14 May 2014. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Identity v3 API in OpenStack Dashboard (Horizon) before 2013.2 does not require the current password when changing passwords for user accounts, which makes it easier for remote attackers to change a user password by leveraging the authentication token for that user.
Weakness: CWE-287
Which versions are affected by CVE-2013-4471?
It affects 1 product.
Products include Openstack Horizon.
How do I fix CVE-2013-4471?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2013-4471 being exploited?
There is no known exploitation of CVE-2013-4471 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2012-2144 OpenStack Horizon Session Fixation
- CVE-2022-45582 Horizon Web Dashboard Open Redirect vulnerability
- CVE-2026-55748 OpenStack Horizon RC file generation does not escape special characters in project names
- CVE-2012-3540 Open redirect in n/a
- CVE-2026-43002 OpenStack Horizon has Incorrect Behavior Order
Sources
Also known as DEBIAN-CVE-2013-4471, GHSA-3hqv-63pg-94p2.