« Volver al listado

CVE-2015-2687

Estado: ModificadaMedia (4.7)—

OpenStack Compute (nova) Icehouse, Juno and Havana when live migration fails allows local users to access VM volumes that they would normally not have permissions for.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Openstack — Compute

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-2687",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 1.9,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.4,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 4.7,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-08-09T18:29:01.183",
  "references": [
    {
      "url": "http://www.openwall.com/lists/oss-security/2015/03/24/10",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2015/03/25/3",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/77505",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://bugs.launchpad.net/nova/+bug/1419577",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205313",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://review.openstack.org/#/c/338929/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2015/03/24/10",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2015/03/25/3",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/77505",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugs.launchpad.net/nova/+bug/1419577",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1205313",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://review.openstack.org/#/c/338929/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenStack Compute (nova) Icehouse, Juno and Havana when live migration fails allows local users to access VM volumes that they would normally not have permissions for."
    },
    {
      "lang": "es",
      "value": "OpenStack Compute (nova) Icehouse, Juno y Havana, cuando la migración en vivo fracasa, permiten que usuarios locales accedan a volúmenes de la máquina virtual a los que normalmente no habrían tenido permiso para hacerlo."
    }
  ],
  "lastModified": "2026-06-17T00:24:33.480",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:openstack:compute:2013.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ABDB4817-2E89-48AF-AA9E-C92966A7100F"
            },
            {
              "criteria": "cpe:2.3:a:openstack:compute:2013.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5778F972-FB4B-49D1-8EE0-5E8B7AE74D38"
            },
            {
              "criteria": "cpe:2.3:a:openstack:compute:2013.2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D43CFCC4-8A0A-4B8D-847E-0CD092B684E7"
            },
            {
              "criteria": "cpe:2.3:a:openstack:compute:2013.2.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "76E07164-57B7-4B0A-994E-3431FD8CF7F2"
            },
            {
              "criteria": "cpe:2.3:a:openstack:compute:2013.2.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3B4036C5-677A-43D4-945F-30F24E318C80"
            },
            {
              "criteria": "cpe:2.3:a:openstack:compute:2014.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F52A2DB6-98A1-4A95-BA81-F2F01160F5E0"
            },
            {
              "criteria": "cpe:2.3:a:openstack:compute:2014.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D2836E5B-26A6-436F-86C0-5FF09D5EB8B8"
            },
            {
              "criteria": "cpe:2.3:a:openstack:compute:2014.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "16034155-9C19-431B-883E-A33D261A66FC"
            },
            {
              "criteria": "cpe:2.3:a:openstack:compute:2014.1.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "70C60DC5-1D6B-447C-95BE-6ACC99815E41"
            },
            {
              "criteria": "cpe:2.3:a:openstack:compute:2014.1.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "58D1ABEA-E5EA-4CA7-B38A-9E6856DF7276"
            },
            {
              "criteria": "cpe:2.3:a:openstack:compute:2014.1.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "50A52648-5D4D-48D1-B901-60BEA4403104"
            },
            {
              "criteria": "cpe:2.3:a:openstack:compute:2014.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2B002A32-4776-488B-B64F-9B692B291E08"
            },
            {
              "criteria": "cpe:2.3:a:openstack:compute:2014.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6E0122E7-B95C-4A4E-B072-41DACB1630AB"
            },
            {
              "criteria": "cpe:2.3:a:openstack:compute:2014.2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D586C76A-0D32-42B9-A981-DD6838B6D682"
            },
            {
              "criteria": "cpe:2.3:a:openstack:compute:2014.2.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2C06721C-BC0E-41DA-B672-84A7C4EF78C2"
            },
            {
              "criteria": "cpe:2.3:a:openstack:compute:2014.2.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "414A9CBC-596C-46B1-8B82-9865FD070A27"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}