CVE-2014-8124

2014-12-1215:59:00

CWE-400

[email protected]

web.nvd.nist.gov

cve-2014-8124

openstack

horizon

denial of service

session management

vulnerability

6.6 Medium

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.018 Low

EPSS

Percentile

87.9%

JSON

OpenStack Dashboard (Horizon) before 2014.1.3 and 2014.2.x before 2014.2.1 does not properly handle session records when using a db or memcached session engine, which allows remote attackers to cause a denial of service via a large number of requests to the login page.

CPENameOperatorVersion
openstack:horizonopenstack horizonlt2014.1.3
openstack:horizonopenstack horizonlt2014.2.1
fedoraproject:fedorafedoraproject fedoraeq21
opensuse:opensuseopensuseeq13.1
oracle:solarisoracle solariseq11.2

CPE	Name	Operator	Version
openstack:horizon	openstack horizon	lt	2014.1.3
openstack:horizon	openstack horizon	lt	2014.2.1
fedoraproject:fedora	fedoraproject fedora	eq	21
opensuse:opensuse	opensuse	eq	13.1
oracle:solaris	oracle solaris	eq	11.2