Access Restriction Bypass in OpenStack Nova by Canonical
CVE-2012-0030

Currently unrated

Key Information:

Vendor

Openstack
Status
Essex
Nova
Vendor
CVE Published:
13 January 2012

What is CVE-2012-0030?

The vulnerability in OpenStack Nova versions 2011.3 and Essex allows remote authenticated users to bypass access restrictions for other tenants. This is achieved through an OSAPI request where the project_id URI parameter can be modified, potentially granting unauthorized access to sensitive data. Such a flaw could severely compromise the security model of tenant isolation within the cloud environment.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/72296
vdb-entryx_refsource_XF
http://secunia.com/advisories/47543
third-party-advisoryx_refsource_SECUNIA
http://www.ubuntu.com/usn/USN-1326-1
vendor-advisoryx_refsource_UBUNTU

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.