CVE-2013-6419

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

1.84%

Published

Jan 7, 2014

Modified

Apr 28, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Interaction error in OpenStack Nova and Neutron before Havana 2013.2.1 and icehouse-1 does not validate the instance ID of the tenant making a request, which allows remote tenants to obtain sensitive metadata by spoofing the device ID that is bound to a port, which is not properly handled by (1) api/metadata/handler.py in Nova and (2) the neutron-metadata-agent (agent/metadata/agent.py) in Neutron.

Weaknesses (CWE)

CWE-200

Affected Products (1)

openstack · havanavulnerable

References (14)

http://rhn.redhat.com/errata/RHSA-2014-0091.html

http://rhn.redhat.com/errata/RHSA-2014-0231.html

http://www.openwall.com/lists/oss-security/2013/12/11/8

Patch

http://www.securityfocus.com/bid/64250

https://bugs.launchpad.net/neutron/+bug/1235450

https://review.openstack.org/#/c/61428/2/nova/api/metadata/handler.py