Vulnerability Description
OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allow remote authenticated users to change the status of their images and bypass access restrictions via the HTTP x-image-meta-status header to images/*.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openstack | Image Registry And Delivery Service \(Glance\) | <= 2014.2.3 |
Related Weaknesses (CWE)
References
- http://rhn.redhat.com/errata/RHSA-2015-1897.html
- https://bugs.launchpad.net/bugs/1482371
- https://security.openstack.org/ossa/OSSA-2015-019.htmlVendor Advisory
- http://rhn.redhat.com/errata/RHSA-2015-1897.html
- https://bugs.launchpad.net/bugs/1482371
- https://security.openstack.org/ossa/OSSA-2015-019.htmlVendor Advisory
FAQ
What is CVE-2015-5251?
CVE-2015-5251 is a vulnerability with a CVSS score of 5.5 (MEDIUM). OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allow remote authenticated users to change the status of their images and bypass access restrictions via the...
How severe is CVE-2015-5251?
CVE-2015-5251 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2015-5251?
Check the references section above for vendor advisories and patch information. Affected products include: Openstack Image Registry And Delivery Service \(Glance\).