« Volver al listado

CVE-2013-4497

Estado: ModificadaMedia (6.4)—

The XenAPI backend in OpenStack Compute (Nova) Folsom, Grizzly, and Havana before 2013.2 does not properly apply security groups (1) when resizing an image or (2) during live migration, which allows remote attackers to bypass intended restrictions.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Openstack — FolsomOpenstack — GrizzlyOpenstack — Havana

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-4497",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2013-11-05T20:55:29.633",
  "references": [
    {
      "url": "http://www.openwall.com/lists/oss-security/2013/11/03/2",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2013/11/03/3",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugs.launchpad.net/nova/+bug/1073306",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugs.launchpad.net/nova/+bug/1202266",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2013/11/03/2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2013/11/03/3",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugs.launchpad.net/nova/+bug/1073306",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugs.launchpad.net/nova/+bug/1202266",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The XenAPI backend in OpenStack Compute (Nova) Folsom, Grizzly, and Havana before 2013.2 does not properly apply security groups (1) when resizing an image or (2) during live migration, which allows remote attackers to bypass intended restrictions."
    },
    {
      "lang": "es",
      "value": "El backend XenAPI en OpenStack Compute (Nova) Folsom, Grizzly, y Habana anterior a 2013.2 no se aplica correctamente los grupos de seguridad (1) al cambiar el tamaño de una imagen o (2) durante la migración en tiempo real, lo que permite a atacantes remotos evitar las restricciones previstas."
    }
  ],
  "lastModified": "2026-06-16T23:57:20.137",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:openstack:havana:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6D92E64B-9490-4A19-8EE2-98B46E5C3A32",
              "versionEndIncluding": "havana-3"
            },
            {
              "criteria": "cpe:2.3:a:openstack:havana:havana-1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "45762277-1BC6-4552-B5AB-756AE8D9F543"
            },
            {
              "criteria": "cpe:2.3:a:openstack:havana:havana-2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "588B9906-F0A0-4109-94D9-11481135ED06"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:openstack:grizzly:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A83ED744-9E3D-4510-B3E6-6DDE1090F0B7"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:openstack:folsom:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F5BA13BC-F088-45AA-AD10-B74F89CE5375"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}