Vendor
OpenStack
77 known vulnerabilities.
Products
38 results · Clear filters · Feed
-
Medium 5.4
OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfi…
-
Medium 5.0
OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nod…
-
Medium 4.3
OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of unc…
-
Medium 4.3
In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin use…
-
Medium 6.0
In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another pr…
-
Medium 6.1
In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests t…
-
Medium 5.3
In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A Temp…
-
Medium 6.3
OpenStack Ironic through 38.0.0 may send a username and password to an unexpected remote host when Image Service is con…
-
Medium 6.3
In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollmen…
-
Medium 4.3
OpenStack Octavia through 18.0.0 mishandles quality of service (QoS) policy authorization. By associating another proje…
-
Medium 6.8
In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NO…
-
Medium 5.0
In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgroups assig…
-
Medium 6.0
In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers (X-Copy-From, X-…
-
Medium 6.0
In OpenStack Swift through 2.38.0, S3API middleware does not enforce that semantic x-amz-* headers are covered by the S…
-
Medium 4.8
OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known.
-
Medium 5.5
In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, …
-
Medium 5.5
OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project without authorization.
-
Medium 5.3
OpenStack Swift vulnerable to authenticated server-side request forgery
In OpenStack Swift before 2.37.2, proxy-server does not strip internal update headers (X-Container-Host, X-Container-Device, X-Delete-At-Host, X-Delete-At-Device) from client requests before forwarding them to object-servers. An authenticated user with write …
-
Medium 6.0
OpenStack Horizon RC file generation does not escape special characters in project names
OpenStack Horizon before 25.7.4 produces scripts for OpenStack RC file downloading that may have a crafted project name with shell metacharacters. NOTE: some parties consider this a security hardening opportunity to address certain types of user error, not a …
-
Medium 5.4
OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints
In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. The resulting instance has no Placement allocation.
-
Medium 6.8
OpenStack Ironic can return unredacted sensitive information when applying a PATCH to update fields in volume properties
In OpenStack Ironic before 37.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensitive information (such as iSCSI credentials). The PATCH outcome is a security issue; the POST outcome …
-
Medium 5.3
OpenStack Ironic: Crafted JSON String to Certain Endpoints on the API or JSON-RPC Service May Result in Service Crash
In OpenStack Ironic 32 before 37.0.0, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or JSON-RPC service and effect a service crash.
-
Medium 5.9
OpenStack Ironic allows file overwrite via directory traversal during deployment with a crafted ISO image
OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image.
-
Medium 4.9
OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Iro…
-
Medium 5.8
OpenStack Ironic allows Boot Script Injection
OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the attacker can set node.driver_info or node.instance_info.
-
Medium 5.3
OpenStack Neutron has an Incorrect Authorization issue
In OpenStack Neutron before 28.0.1, the tagging controller enforces plural policy action names on single-tag write operations while the defined policy rules use singular names. The mismatched names evaluate as allowed under the default policy, permitting a pr…
-
Medium 6.0
OpenStack Keystone's federated token rescoping mechanism doesn't propagate the original token's expiry to the newly issued token
An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the original token's expiry to the newly issued token. When a federated user rescopes a token via POST /v3/auth/tokens, the handle…
-
Medium 6.0
OpenStack Keystone has an Authorization Bypass
An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in enforce_call unconditionally merges the raw JSON request body into the policy enforcement dictionary via policy_dict.update(json_input.copy()), overwriting trust…
-
Medium 6.0
OpenStack Keystone doesn't verify that the user supplied in the authentication request matches the owner of the application credential
An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone application credential authentication plugin does not verify that the user supplied in the authentication request matches the owner of the application credential. An attacker can authen…
-
Medium 6.0
OpenStack Keystone has an Incorrect Authorization issue
An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the member role on a project can escalate to admin by chaining unrestricted application credentials with Ke…
-
Medium 4.3
OpenStack Ironic: Pre-Validation Checksum Calculation allows Denial of Service (DoS) via Infinite Block Devices
In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop in checksum calculations can occur via the file:///dev/zero URL.
-
Medium 6.3
OpenStack Cyborg's Accelerator Request (ARQ) API does not enforce project ownership at any layer
In OpenStack Cyborg before 16.0.1, the Accelerator Request (ARQ) API does not enforce project ownership at any layer. The project_id column in the database is never populated (NULL for every ARQ), database queries have no project filtering, and policy checks …
-
Medium 5.3
OpenStack Horizon has Incorrect Behavior Order
An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3. There is a write operation to the session storage backend before authentication and thus storage can be exhausted by unauthenticated requests. This is a regression of the CVE-2014-8124 …
-
Medium 6.6
OpenStack Ironic is Vulnerable to Inclusion of Functionality from Untrusted Control Sphere
OpenStack Ironic before 35.0.1 allows ipmitool execution in a non-default configuration that has a console interface.
-
Medium 5.4
OpenStack Skyline before 5.0.1, 6.0.0, and 7.0.0 has a DOM-based Cross-Site Scripting (XSS) vulnerability in the consol…
-
Medium 5.0
OpenStack Glance is affected by Server-Side Request Forgery (SSRF)
OpenStack Glance before 29.1.1, 30.x before 30.1.1, and 31.0.0 is affected by Server-Side Request Forgery (SSRF). By use of HTTP redirects, an authenticated user can bypass URL validation checks and redirect to internal services. Only glance image import func…
-
Medium 5.9
OpenStack Keystone and other components vulnerable to Improper Certificate Validation
HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates.
-
Medium 6.3
Openstack tripleo-heat-templates unauthenticated file access
A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as tho…