CVE-2011-4596

OpenStack Nova < 2011.3.1 - Authenticated Path Traversal via S3/RegisterImage Tarball or Manifest

Title source: llm
STIX 2.1

Description

Multiple directory traversal vulnerabilities in OpenStack Nova before 2011.3.1, when the EC2 API and the S3/RegisterImage image-registration method are enabled, allow remote authenticated users to overwrite arbitrary files via a crafted (1) tarball or (2) manifest.

References (5)

Core 5
Core References
Third Party Advisory x_refsource_confirm
https://bugs.launchpad.net/nova/+bug/894755
Third Party Advisory mailing-list x_refsource_mlist
https://lists.launchpad.net/openstack/msg06105.html
Third Party Advisory x_refsource_confirm
https://bugs.launchpad.net/nova/+bug/885167

Scores

EPSS 0.0054
EPSS Percentile 67.8%

Details

CWE
CWE-22
Status published
Products (2)
openstack/nova 2011.3 - 2011.3.1
pypi/nova 0 - 12.0.0a0PyPI
Published Dec 23, 2011
Tracked Since Feb 18, 2026