CVE-2013-0266 | BDVDB-2026-54883 Detail

Description#

A flaw was found in the `puppetlabs-cinder` module, as used in PackStack. This vulnerability is due to incorrect file permissions, specifically world-readable permissions, on the `cinder.conf` and `api-paste.ini` configuration files. A local user can exploit this by reading these files, which leads to the disclosure of OpenStack administrative passwords. This information disclosure could allow unauthorized access to sensitive OpenStack resources.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12013-03-08Record published in the CVE List.
2. Version 22026-10-30Most recent update recorded in the CVE List.