CVE-2013-4471 | BDVDB-2026-61549 Detail

Description#

The Identity v3 API in OpenStack Dashboard (Horizon) before 2013.2 does not require the current password when changing passwords for user accounts, which makes it easier for remote attackers to change a user password by leveraging the authentication token for that user.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://lists.openstack.org/pipermail/openstack/2013-November/003299.html
https://bugs.launchpad.net/horizon/+bug/1237989

Exploit#

No public exploit known

History#

Version 12014-05-14Record published in the CVE List.
Version 22024-08-06Most recent update recorded in the CVE List.