CVE-2013-1840
mediumA flaw was found in OpenStack Glance.
Vendor / product: Openstack — glance
A flaw was found in OpenStack Glance. Remote authenticated users can exploit this vulnerability by requesting a cached image when the single-tenant Swift or S3 store is in use. This action causes the system to report the location field, which can lead to the disclosure of the operator's backend credentials.
CVSS
6.5
6.5 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Severity source: NVD CVSS v3.1 (secalert@redhat.com)
Timeline (UTC)
Published: 2013-03-22 21:55
Modified: 2026-10-30 19:17
NVD status: Modified
Last synced 18 hours ago
Verified against the source API 2026-10-30 19:20 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
openstack / glance v1
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Vendor advisory: http://secunia.com/advisories/52565
Vendor advisory: http://secunia.com/advisories/52565
References
- http://osvdb.org/91304 secalert@redhat.com
- http://rhn.redhat.com/errata/RHSA-2013-0707.html secalert@redhat.com
- http://secunia.com/advisories/52565 secalert@redhat.com
- http://www.openwall.com/lists/oss-security/2013/03/14/15 secalert@redhat.com
- http://www.securityfocus.com/bid/58490 secalert@redhat.com
- http://www.ubuntu.com/usn/USN-1764-1 secalert@redhat.com
- https://access.redhat.com/errata/RHSA-2013:0707 secalert@redhat.com
- https://access.redhat.com/security/cve/CVE-2013-1840 secalert@redhat.com
- https://bugs.launchpad.net/glance/+bug/1135541 secalert@redhat.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/82878 secalert@redhat.com
- https://review.openstack.org/#/c/24437/ secalert@redhat.com
- https://review.openstack.org/#/c/24438/ secalert@redhat.com
- https://review.openstack.org/#/c/24439/ secalert@redhat.com
- http://osvdb.org/91304 af854a3a-2127-422b-91ae-364da2661108
- http://rhn.redhat.com/errata/RHSA-2013-0707.html af854a3a-2127-422b-91ae-364da2661108
- http://secunia.com/advisories/52565 af854a3a-2127-422b-91ae-364da2661108
- http://www.openwall.com/lists/oss-security/2013/03/14/15 af854a3a-2127-422b-91ae-364da2661108
- http://www.securityfocus.com/bid/58490 af854a3a-2127-422b-91ae-364da2661108
- http://www.ubuntu.com/usn/USN-1764-1 af854a3a-2127-422b-91ae-364da2661108
- https://bugs.launchpad.net/glance/+bug/1135541 af854a3a-2127-422b-91ae-364da2661108
- https://exchange.xforce.ibmcloud.com/vulnerabilities/82878 af854a3a-2127-422b-91ae-364da2661108
- https://review.openstack.org/#/c/24437/ af854a3a-2127-422b-91ae-364da2661108
- https://review.openstack.org/#/c/24438/ af854a3a-2127-422b-91ae-364da2661108
- https://review.openstack.org/#/c/24439/ af854a3a-2127-422b-91ae-364da2661108
Data sources
NVD CVE API 2.0 — fetched 2026-10-30 19:20 UTC · record ↗