What is the CVSS score of CVE-2013-0335?

CVE-2013-0335 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L. EPSS exploitation probability: 1.0%.

Which versions of OpenStack Nova are affected by CVE-2013-0335?

OpenStack Nova versions Essex, Folsom, and Grizzly contain a tenant isolation vulnerability (CVE-2013-0335) that allows authenticated tenant users to gain console access to other tenants' virtual…. A patch is available.

How to fix or mitigate CVE-2013-0335?

Within 24 hours, audit all OpenStack deployments to identify instances of Nova versions Essex (2012.1), Folsom (2012.2), or Grizzly (2012.2) and document exposure. Within 7 days, deploy the available vendor patch to all affected instances or decommission these unsupported releases and migrate workloads to supported versions. Complete remediation verification within 30 days and document patch application in your infrastructure management system.

OpenStack Nova CVE-2013-0335

HIGH

Permissions, Privileges, and Access Controls (CWE-264)

2013-03-22 secalert@redhat.com

Privilege Escalation Essex Folsom Grizzly Ubuntu Linux

7.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.6 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

vuln.today AI

6.8 MEDIUM

AC:H reflects opportunistic timing dependency on VNC port recycling; C:H and I:H reflect full VM console access; A:N as no availability impact is described.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Updated

Jul 31, 2026 - 15:28 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Jul 31, 2026 - 15:22 vuln.today

cvss_changed

Severity Changed

Jul 31, 2026 - 15:22 NVD

MEDIUM HIGH

CVSS changed

Jul 31, 2026 - 15:22 NVD

6.0 (MEDIUM) 7.6 (HIGH)

CVE Published

Mar 22, 2013 - 21:55 cve.org

MEDIUM 6.0

DescriptionNVD

OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to gain access to a VM in opportunistic circumstances by using the VNC token for a deleted VM that was bound to the same VNC port.

AnalysisAI

VNC token lifecycle mismanagement in OpenStack Nova (Essex 2012.1, Folsom 2012.2, Grizzly 2012.2) allows an authenticated tenant user to gain unauthorized interactive console access to another tenant's running VM under opportunistic timing conditions. When a VM is deleted, Nova fails to invalidate its associated VNC token; if the VNC port is subsequently recycled to a new VM, the stale token becomes valid for that new VM, breaking tenant isolation. No public exploit has been identified at time of analysis, and the EPSS score of 1.04% (77th percentile) reflects limited real-world exploitation, consistent with the timing-dependent nature of the attack and the end-of-life status of all affected releases.

Technical ContextAI

OpenStack Nova is the IaaS compute service responsible for VM lifecycle management, including brokering VNC console access via a proxy that issues ephemeral per-user tokens. The root cause, classified under CWE-264 (Permissions, Privileges, and Access Controls), is the failure to invalidate or revoke VNC tokens upon VM deletion. VNC port assignments are drawn from a finite pool and recycled; when a deleted VM's port is reallocated to a subsequent VM, any outstanding token referencing the original port silently becomes valid for the new VM. CPE data confirms the affected components as cpe:2.3:a:openstack:essex:2012.1, cpe:2.3:a:openstack:folsom:2012.2, and cpe:2.3:a:openstack:grizzly:2012.2, along with Ubuntu Linux distributions 11.10, 12.04 LTS, and 12.10 that shipped these Nova versions.

RemediationAI

Apply the vendor-released patches for affected Nova releases; Ubuntu users should follow USN-1771-1 (http://www.ubuntu.com/usn/USN-1771-1) and Red Hat users should apply RHSA-2013-0709 (http://rhn.redhat.com/errata/RHSA-2013-0709.html). Upstream OpenStack fixes are tracked via Launchpad bug 1125378 and implemented in OpenStack Gerrit reviews 22086, 22758, and 22872 (https://review.openstack.org). The exact patched release version is not independently stated in the available references beyond these upstream review links - treat these as upstream fix commits rather than a confirmed tagged release. As a compensating control where immediate patching is not feasible, operators can restrict VNC proxy access to only the originating tenant's network segment, reducing the window for stale token reuse; note this does not eliminate the underlying token invalidation defect and adds operational overhead. Because Essex, Folsom, and Grizzly are all end-of-life releases, migration to a supported OpenStack release is the recommended long-term remediation.