CVE-2013-4471
Medium
Description
The Identity v3 API in OpenStack Dashboard (Horizon) before 2013.2 does not require the current password when changing passwords for user accounts, which makes it easier for remote attackers to change a user password by leveraging the authentication token for that user.
SeverityMedium
CVSS5.5
Exploit probability—
ProductOpenstack Horizon
PublishedMay 14, 2014
First seenMay 14, 2014
How to fix
Update
- openstack horizon2013.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openstack horizon | 2013.1 ≤ v < 2013.2 | 2013.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.