The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.1.4 and…
Priority LOW 34CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub.
Summary
The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote authenticated users to read or delete arbitrary files via a full pathname in a filesystem: URL in the image location property. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9493.
Why it matters now
EPSS 0.02792 86th percentileScored 2026-11-07
Fix Fixed glance (PyPI): 11.0.0a0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | glance (PyPI) | before 11.0.0a0 | 11.0.0a0 | Patch available | GHSA-pwrj-f53c-f89j |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- glance (PyPI) Vendor— Affected before 11.0.0a0 Fixed in 11.0.0a0 Patch available GHSA-pwrj-f53c-f89j
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:openstack:image_registry_and_delivery_service_\(glance\):*:*:*:*:*:*:*:* | 2014.1 to before 2014.1.4; 2014.2 to before 2014.2.2 | Vulnerable | OpenStack |
- cpe:2.3:a:openstack:image_registry_and_delivery_service_\(glance\):*:*:*:*:*:*:*:* Versions 2014.1 to before 2014.1.4; 2014.2 to before 2014.2.2 Vulnerable ·OpenStack
Remediation
- Fix · GHSA-pwrj-f53c-f89j glance (PyPI) Fixed in 11.0.0a0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
Not affected: 7 products
- Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse)
- Red Hat Enterprise Linux OpenStack Platform 6 (Juno)
- Red Hat OpenStack Platform 13 (Queens)
- Red Hat OpenStack Platform 16.2
- Red Hat OpenStack Platform 17.1
- Red Hat OpenStack Platform 18.0
- Red Hat OpenStack Platform 4
Timeline
- 2026-10-02 Threatist record created from CVE-2015-1195
- 2026-10-03 Alias added: GHSA-pwrj-f53c-f89j
- 2026-10-07 Affected versions changed · Red Hat
- 2026-10-08 Affected versions changed · Red Hat
References
Advisory 6
- [openstack-announce] 20150120 [OSSA 2015-002.1] Glance v2 API unrestricted path traversal through filesystem:// scheme (CVE-2015-1195) ERRATA 1
- https://bugs.launchpad.net/ossa/+bug/1408663
- [oss-security] 20150118 Re: [OSSA 2015-002] Glance v2 API unrestricted path traversal through filesystem:// scheme
- [oss-security] 20150115 [OSSA 2015-002] Glance v2 API unrestricted path traversal through filesystem:// scheme
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- https://nvd.nist.gov/vuln/detail/CVE-2015-1195
More OpenStack Image Registry And Delivery Service (glance) vulnerabilities
- TI-2015-04442 OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2… CVSS 2.0MEDIUM 6.8
- TI-2014-00156 The Sheepdog backend in OpenStack Image Registry and Delivery Service (Glance) 2013.2… CVSS 2.0MEDIUM 6.0
- TI-2012-03913 The v1 API in OpenStack Glance Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote… CVSS 2.0MEDIUM 5.5
- TI-2014-07716 The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.2.2 and… CVSS 2.0MEDIUM 5.5
- TI-2012-04601 The v2 API in OpenStack Glance Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote… CVSS 2.0MEDIUM 5.5
- TI-2015-04410 OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2… CVSS 2.0MEDIUM 5.5
Sources
- CVE-2015-1195 · CVE Program
- CVE-2015-1195 · NVD
- FIRST EPSS
- GHSA-pwrj-f53c-f89j · GitHub Advisory Database · CC BY 4.0
- CVE-2015-1195 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences