CVE-2014-9493

CVE Details

Release Date:	2014-12-15
Impact:	Important	What is this?

Description

It was discovered that an authenticated user could use a path traversal flaw in glance to download or delete any file on the glance server that is accessible to the glance process user. Note that only setups using the OpenStack Image V2 API were affected by this flaw.

See more information about CVE-2014-9493 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v2 metrics

Base Score:	5.5
Vector String:	AV:N/AC:L/Au:S/C:P/I:P/A:N
Version:	2.0
Attack Vector:	Network
Attack Complexity:	Low
Authentication:	Single
Confidentiality Impact:	Partial
Integrity Impact:	Partial
Availability Impact:	None

Errata information

Platform	Errata	Release Date
Oracle Linux version 6 (openstack-glance)	OLOSSA-2015-0024	2015-03-13