CVE-2013-6428 The ReST API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 allows remote authenticated users to bypass the tenant scoping restrictions via a modified tena...
MediumCVSS 4.0
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The ReST API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 allows remote authenticated users to bypass the tenant scoping restrictions via a modified tenant_id in the request path.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/heat(Debian:12) | < 2013.2.1-1 | 2013.2.1-1 |
| debian/heat(Debian:13) | < 2013.2.1-1 | 2013.2.1-1 |
| debian/heat(Debian:14) | < 2013.2.1-1 | 2013.2.1-1 |
| OpenStack heat | <= 2013.2 | No fix listed |
References
- Debian Security Tracker CVE-2013-6428 vendor-advisory
- RHSA-2014:0090 vendor-advisory
- [oss-security] 20131211 [OSSA 2013-035] Heat ReST API doesn't respect tenant scoping (CVE-2013-6428) mailing-list
- launchpad.net exploit patch
- bugs.debian.org issue-tracking