What is the CVSS score of CVE-2013-4278?

CVE-2013-4278 has a CVSS 2.0 base score of 3.5 (Low). CVSS vector: AV:N/AC:M/Au:S/C:P/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2013-4278?

Yes, a patch is available for CVE-2013-4278. Update the affected software to the latest version immediately.

Compute CVE-2013-4278

LOW

Permissions, Privileges, and Access Controls (CWE-264)

2013-09-16 secalert@redhat.com

Privilege Escalation Compute

3.5

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

3.5 LOW

AV:N/AC:M/Au:S/C:P/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:M/Au:S/C:P/I:N/A:N

Attack Vector

Network

Attack Complexity

Confidentiality

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Sep 16, 2013 - 19:14 cve.org

LOW 3.5

DescriptionCVE.org

The "create an instance" API in OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to boot arbitrary flavors by guessing the flavor id. NOTE: this issue is due to an incomplete fix for CVE-2013-2256.

AnalysisAI

The "create an instance" API in OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to boot. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable.

Technical ContextAI

This vulnerability is classified under CWE-264. The "create an instance" API in OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to boot arbitrary flavors by guessing the flavor id. NOTE: this issue is due to an incomplete fix for CVE-2013-2256. Affected products include: Openstack Compute.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.