Read the docs

OpenStack

Records333All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical23CVSS 9.0–10.0
CVSS high77CVSS 7.0–8.9

Exploited now

OpenStack records in CISA KEV

No OpenStack vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Keystone 44 records MEDIUM Nova 39 records HIGH Folsom 25 records LOW Neutron 25 records MEDIUM Horizon 24 records MEDIUM Essex 15 records LOW Image Registry And Delivery Service (glance) 15 records LOW Swift 15 records MEDIUM

Records

39 records in Nova · all components

TI-2022-23762 CVE-2022-47951 · GHSA-7h75-hwxx-qpgc

An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and…

Priority MEDIUM 59

An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0.

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.01063 Published 2023-01-26 Fixed in 19.1.2, 20.0.2 +4 CWE-22
TI-2021-02596 CVE-2021-3654 · GHSA-vqp6-j452-j6wp

Open redirect in openstack-nova

Priority MEDIUM 49

A vulnerability was found in openstack-nova's console proxy, noVNC.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.26792 Published 2022-03-02 Partial fix · 21.2.3, 22.2.3 +1 CWE-601
TI-2011-02777 CVE-2011-3147 · GHSA-hqfx-4x4w-vmwp

qcow format could expose host filesystem information

Priority LOW 39

Versions of nova before 2012.1 could expose hypervisor host files to a guest operating system when processing a maliciously constructed qcow filesystem.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.0074 Published 2019-04-22 Fixed in 12.0.0a0 CWE-200
TI-2015-04330 CVE-2015-5162 · GHSA-g2j5-7vgx-6xrx

The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1…

Priority LOW 38

The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0 does not properly limit qemu-img calls, which might allow attackers to cause a denial…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.03088 Published 2016-10-07 Partial fix · 7.0.2, 9.0.0 +2 CWE-399
TI-2015-02901 CVE-2015-3280 · GHSA-mfmj-gwg3-vhw7

OpenStack Compute (nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) does…

Priority LOW 36

OpenStack Compute (nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) does not properly delete instances from compute nodes, which allows remote authenticated users to cause a denial of service (disk consum…

CVSS 2.0MEDIUM 6.8 Network Low privileges Interaction — EPSS 0.03381 Published 2015-10-26 Fixed in 2014.2.4, 2015.1.2 CWE-399
TI-2015-02870 CVE-2015-3241 · GHSA-3vx7-xff6-h2vx

OpenStack Compute (nova) 2015.1 through 2015.1.1, 2014.2.3, and earlier does not stop the…

Priority LOW 36

OpenStack Compute (nova) 2015.1 through 2015.1.1, 2014.2.3, and earlier does not stop the migration process when the instance is deleted, which allows remote authenticated users to cause a denial of service (disk, networ…

CVSS 2.0MEDIUM 6.8 Network Low privileges Interaction — EPSS 0.0348 Published 2015-09-08 Fixed in 112.0.0.0b3 CWE-399
TI-2014-07179 CVE-2014-8750 · GHSA-2pcw-fgm2-4xh2

Race condition in the VMware driver in OpenStack Compute (Nova) before 2014.1.4 and…

Priority LOW 33

Race condition in the VMware driver in OpenStack Compute (Nova) before 2014.1.4 and 2014.2 before 2014.2rc1 allows remote authenticated users to access unintended consoles by spawning an instance that triggers the same V…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.02027 Published 2014-10-15 Fixed CWE-362
TI-2017-11953 CVE-2017-16239 · GHSA-w2wf-cgwh-vpqg

In OpenStack Nova through 14.0.9, 15.x through 15.0.7, and 16.x through 16.0.2, by…

Priority LOW 32

In OpenStack Nova through 14.0.9, 15.x through 15.0.7, and 16.x through 16.0.2, by rebuilding an instance, an authenticated user may be able to circumvent the Filter Scheduler bypassing imposed filters (for example, the…

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01421 Published 2017-11-14 Partial fix · 16.0.3, 15.0.8 +1
TI-2015-07199 CVE-2015-8749 · GHSA-c36r-g737-9qp8

The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3…

Priority LOW 31

The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen ba…

CVSS 3.0MEDIUM 5.9 Network No auth No interaction EPSS 0.0224 Published 2016-01-15 Fixed in 12.0.1 CWE-200
TI-2013-02016 CVE-2013-2256 · GHSA-5mj6-643f-2g85

OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-2 does not properly…

Priority LOW 31

OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-2 does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to obtain sensitive information (flavor prope…

CVSS 2.0MEDIUM 6.0 Network Low privileges Interaction — EPSS 0.01844 Published 2013-09-16 Partial fix · 2013.1.3 CWE-264
TI-2011-03962 CVE-2011-4596 · GHSA-qr62-r9xc-r2gj

Multiple directory traversal vulnerabilities in OpenStack Nova before 2011.3.1, when the…

Priority LOW 30

Multiple directory traversal vulnerabilities in OpenStack Nova before 2011.3.1, when the EC2 API and the S3/RegisterImage image-registration method are enabled, allow remote authenticated users to overwrite arbitrary fil…

CVSS 2.0MEDIUM 6.0 Network Low privileges Interaction — EPSS 0.01761 Published 2011-12-23 Fixed in 12.0.0a0 CWE-22
TI-2015-06409 CVE-2015-7713 · GHSA-67rh-9p29-vrxr

OpenStack Compute (Nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) do…

Priority LOW 29

OpenStack Compute (Nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) do not properly apply security group changes, which allows remote attackers to bypass intended restriction by leveraging an instance tha…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.037 Published 2015-10-29 Fixed in 2014.2.4, 2015.1.2 CWE-254
TI-2011-03595 CVE-2011-4076 · GHSA-vcmv-6rxx-fh7r

Information disclosure in nova

Priority LOW 29

OpenStack Nova before 2012.1 allows someone with access to an EC2_ACCESS_KEY (equivalent to a username) to obtain the EC2_SECRET_KEY (equivalent to a password).

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.01458 Published 2019-11-26 Fixed in 12.0.0a0 CWE-200
TI-2016-01952 CVE-2016-2140 · GHSA-49jv-37hm-6gfp

The libvirt driver in OpenStack Compute (Nova) before 2015.1.4 (kilo) and 12.0.x before…

Priority LOW 28

The libvirt driver in OpenStack Compute (Nova) before 2015.1.4 (kilo) and 12.0.x before 12.0.3 (liberty), when using raw storage and use_cow_images is set to false, allows remote authenticated users to read arbitrary fil…

CVSS 3.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.02108 Published 2016-04-12 Fixed in 12.0.3 CWE-200
TI-2012-02975 CVE-2012-3447 · GHSA-xc4g-7vw8-924h

virt/disk/api.py in OpenStack Compute (Nova) 2012.1.x before 2012.1.2 and Folsom before…

Priority LOW 26

virt/disk/api.py in OpenStack Compute (Nova) 2012.1.x before 2012.1.2 and Folsom before Folsom-3 allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an image that uses a symli…

CVSS 2.0MEDIUM 4.9 Network Low privileges Interaction — EPSS 0.01933 Published 2012-08-20 Fixed in 12.0.0 CWE-264
TI-2015-00227 CVE-2015-0259 · GHSA-x8xr-rm9r-7mvf

OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before…

Priority LOW 25

OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the authentication of users for acces…

CVSS 2.0MEDIUM 5.1 Network No auth Interaction — EPSS 0.0107 Published 2015-04-01 Partial fix · 2014.1.4, 2014.2.3 CWE-345
Load more
Open these records in search →