CVE-2013-6428

OpenStack Heat < 2013.2 - Authenticated Tenant Restriction Bypass via Modified tenant_id

Title source: llm

Description

The ReST API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 allows remote authenticated users to bypass the tenant scoping restrictions via a modified tenant_id in the request path.

References (3)

Core 3

Core References

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2014-0090.html

Exploit, Patch x_refsource_confirm

https://launchpad.net/bugs/1256983

Mailing List mailing-list x_refsource_mlist

http://seclists.org/oss-sec/2013/q4/479

Scores

EPSS 0.0017

EPSS Percentile 37.8%

Details

CWE

CWE-264

Status published

Products (1)

openstack/heat < 2013.2

Published Dec 14, 2013

Tracked Since Feb 18, 2026