CVE-2013-4354

Published: Nov 23, 2013Modified: Apr 29, 2026

2.1

Vector

AV:L/AC:L/Au:N/C:N/I:P/A:N

Exploitability: 3.9 / Impact: 2.9

Source: NVD

Description

The API before 2.1 in OpenStack Image Registry and Delivery Service (Glance) makes it easier for local users to inject images into arbitrary tenants by adding the tenant as a member of the image.

Affected (1)

Products: Openstack: Image Registry And Delivery Service (glance)

Openstack

1 product

Image Registry And Delivery Service (glance)

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Openstack Image Registry And Delivery Service (glance)	All versions

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (6)

http://www.openwall.com/lists/oss-security/2013/09/19/2

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2013/09/19/3

Source: secalert@redhat.com

https://bugs.launchpad.net/glance/+bug/1226078

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2013/09/19/2

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2013/09/19/3

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugs.launchpad.net/glance/+bug/1226078

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.