TI-2013-03674 Aliases CVE-2013-4202 GHSA-mfg4-9xf4-f45q

The (1) backup (api/contrib/backups.py) and (2) volume transfer…

LOW 25CWE-399Published 2013-09-16 · Updated 2024-08-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Medium
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Partial
Fix status: Partial Red Hat: 1 fixed, 1 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-399 and the CVSS impact.

Summary

The (1) backup (api/contrib/backups.py) and (2) volume transfer (contrib/volume_transfer.py) APIs in OpenStack Cinder Grizzly 2013.1.3 and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664.

Why it matters now

EPSS 0.02626 85th percentileScored 2026-11-07

Fix Partial cinder (PyPI): 7.0.0a0Red Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	cinder (PyPI)	before 7.0.0a0	7.0.0a0	Patch available	GHSA-mfg4-9xf4-f45q

— Vendor— Affected all versions Fixed in — No fix listed CNA
cinder (PyPI) Vendor— Affected before 7.0.0a0 Fixed in 7.0.0a0 Patch available GHSA-mfg4-9xf4-f45q

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:openstack:cinder::::::::	2013.1 – 2013.1.3	Vulnerable	OpenStack
cpe:2.3:o:canonical:ubuntu_linux:13.04:::::::*	13.04	Vulnerable	Canonical

cpe:2.3:a:openstack:cinder:*:*:*:*:*:*:*:* Versions 2013.1 – 2013.1.3 Vulnerable ·OpenStack
cpe:2.3:o:canonical:ubuntu_linux:13.04:*:*:*:*:*:*:* Versions 13.04 Vulnerable ·Canonical

Remediation

Fix · GHSA-mfg4-9xf4-f45q cinder (PyPI) Fixed in 7.0.0a0 Advisory →

Red Hat 1 advisory

RHSA-2013:1198 Released 2013-09-03 · Red Hat rating Moderate
openstack-cinder security update
- Red Hat Enterprise Linux OpenStack Platform 3.0 openstack-cinder-2013.1.3-2.el6ost, openstack-cinder-doc-2013.1.3-2.el6ost, python-cinder-2013.1.3-2.el6ost

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat OpenStack Platform 4	Affected	No fix yet
Red Hat Enterprise Linux OpenStack Platform 3.0	Fixed	RHSA-2013:1198

Timeline

2026-10-02 Threatist record created from CVE-2013-4202
2026-10-03 Alias added: GHSA-mfg4-9xf4-f45q

References

Patch 1

RHSA-2013:1198

Advisory 3

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences