Read the docs
TI-2012-00029 Aliases CVE-2012-0030GHSA-3c45-vg2q-j67q

Nova 2011.3 and Essex, when using the OpenStack API, allows remote authenticated users to…

Priority LOW 26CWE-264Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Security bypass
Confidentiality · integrity · availability
None · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-264.

Summary

Nova 2011.3 and Essex, when using the OpenStack API, allows remote authenticated users to bypass access restrictions for tenants of other users via an OSAPI request with a modified project_id URI parameter.

Why it matters now

EPSS 0.01694 77th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:openstack:essex:*:*:*:*:*:*:*:*all versionsVulnerableOpenStack
cpe:2.3:a:openstack:nova:2011.3:*:*:*:*:*:*:*2011.3VulnerableOpenStack
  • cpe:2.3:a:openstack:essex:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:nova:2011.3:*:*:*:*:*:*:* Versions 2011.3 Vulnerable ·OpenStack

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-0030
  2. 2026-10-03 Alias added: GHSA-3c45-vg2q-j67q

References

Patch 1

Advisory 1

Other 1

  • TI-2013-00195 Packstack: packstack: arbitrary file overwrite via symlink attack CVSS 3.1HIGH 8.8
  • TI-2013-00265 Openstack nova: vnc proxy can connect to the wrong vm CVSS 3.1HIGH 7.6
  • TI-2013-00142 The boot-from-volume feature in OpenStack Compute (Nova) Folsom and Essex, when using… CVSS 2.0MEDIUM 6.5
  • TI-2012-03913 The v1 API in OpenStack Glance Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote… CVSS 2.0MEDIUM 5.5
  • TI-2012-04601 The v2 API in OpenStack Glance Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote… CVSS 2.0MEDIUM 5.5
  • TI-2012-02892 virt/disk/api.py in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo… CVSS 2.0MEDIUM 5.5
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences