Lucene search
HistoryMar 08, 2013 - 9:55 p.m.
CVE-2013-0266
cve-2013-0266
puppetlabs-cinder
packstack
openstack
security vulnerability
configuration files
local users
administrative passwords
2.1 Low
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:N/A:N
6.4 Medium
AI Score
Confidence
Low
0.0004 Low
EPSS
Percentile
5.1%
manifests/base.pp in the puppetlabs-cinder module, as used in PackStack, uses world-readable permissions for the (1) cinder.conf and (2) api-paste.ini configuration files, which allows local users to read OpenStack administrative passwords by reading the files.
Affected configurations
Node
openstackessexMatch-
ORopenstackfolsomMatch-
| CPE | Name | Operator | Version |
|---|---|---|---|
| openstack:essex | openstack essex | eq | - |
| openstack:folsom | openstack folsom | eq | - |
Related
cvelist
cvelist
CVE-2013-0266
2013-03-08 21:00:00
nvd
nvd
CVE-2013-0266
2013-03-08 21:55:01
prion
prion
Design/Logic Flaw
2013-03-08 21:55:00
redhat
redhat
(RHSA-2013:0595) Moderate: openstack-packstack security and bug fix update
2013-03-05 00:00:00
2.1 Low
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:N/A:N
6.4 Medium
AI Score
Confidence
Low
0.0004 Low
EPSS
Percentile
5.1%
Related for CVE-2013-0266