CVE-2016-2140

MEDIUM

Openstack Nova < 12.0.3 - Information Disclosure

Title source: rule

Description

The libvirt driver in OpenStack Compute (Nova) before 2015.1.4 (kilo) and 12.0.x before 12.0.3 (liberty), when using raw storage and use_cow_images is set to false, allows remote authenticated users to read arbitrary files via a crafted qcow2 header in an ephemeral or root disk.

References (4)

Scores

CVSS v3 5.3
EPSS 0.0063
EPSS Percentile 70.0%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Classification

CWE
CWE-200
Status draft

Affected Products (2)

openstack/nova < 12.0.3
pypi/nova < 12.0.3PyPI

Timeline

Published Apr 12, 2016
Tracked Since Feb 18, 2026