CVE-2013-6428

The ReST API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 allows remote authenticated users to bypass the tenant scoping restrictions via a modified tenant_id in the request path.

Score

CVSS 2.0 4.0 Medium

Status

Modified - secalert@redhat.com

Published

2013-12-14

Last modified

2024-08-06

Weaknesses

CWE-264

Affected products

• Heat (Openstack)

References

• http://rhn.redhat.com/errata/RHSA-2014-0090.html
• http://seclists.org/oss-sec/2013/q4/479
• https://launchpad.net/bugs/1256983