CVE-2013-4179

2013-09-1619:14:38

CWE-119

[email protected]

web.nvd.nist.gov

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

AI Score

9.2

Confidence

High

EPSS

0.09

Percentile

94.6%

JSON

The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664.

Affected configurations

Nvd

Node

openstackhavanaRange≤havana-2

openstackhavanaMatchhavana-1

Node

openstackcomputeMatch2013.1.3

VendorProductVersionCPE
openstackhavana*cpe:2.3:a:openstack:havana:*:*:*:*:*:*:*:*
openstackhavanahavana-1cpe:2.3:a:openstack:havana:havana-1:*:*:*:*:*:*:*
openstackcompute2013.1.3cpe:2.3:a:openstack:compute:2013.1.3:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
openstack	havana	*	cpe:2.3:a:openstack:havana::::::::
openstack	havana	havana-1	cpe:2.3:a:openstack:havana:havana-1:::::::*
openstack	compute	2013.1.3	cpe:2.3:a:openstack:compute:2013.1.3:::::::*