CVE-2013-6480

Libcloud does not properly scrub data when destroying a DigitalOcean node

2.1 LowPublic exploitFix available

Libcloud 0.12.3 through 0.13.2 does not set the scrub_data parameter for the destroy DigitalOcean API, which allows local users to obtain sensitive information by leveraging a new VM.

Exploit likelihood

2.06%Down 3.4 points since Feb 4, 2022

What each source reports

NVD Score used 2.1

Libcloud 0.12.3 through 0.13.2 does not set the scrub_data parameter for the destroy DigitalOcean API, which allows local users to obtain sensitive information by leveraging a new VM.

Record: CVE-2013-6480
CVSS 2.0: 2.1 LowAV:L/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

CVE List No score

Libcloud 0.12.3 through 0.13.2 does not set the scrub_data parameter for the destroy DigitalOcean API, which allows local users to obtain sensitive information by leveraging a new VM.

Record: CVE-2013-6480
Updated: 2026-11-02

EUVDEUVD-2014-0003 No score

Libcloud 0.12.3 through 0.13.2 does not set the scrub_data parameter for the destroy DigitalOcean API, which allows local users to obtain sensitive information by leveraging a new VM.

Record: EUVD-2014-0003
Updated: 2026-11-03

GitHub AdvisoriesGHSA-g892-9h8m-r69r No score

Libcloud does not properly scrub data when destroying a DigitalOcean node

Libcloud 0.12.3 through 0.13.2 does not set the scrub_data parameter for the destroy DigitalOcean API, which allows local users to obtain sensitive information by leveraging a new VM.

Record: GHSA-g892-9h8m-r69r
Weakness: CWE-200
Updated: 2026-11-02

OSVGHSA-g892-9h8m-r69r No score

Libcloud does not properly scrub data when destroying a DigitalOcean node

Libcloud 0.12.3 through 0.13.2 does not set the scrub_data parameter for the destroy DigitalOcean API, which allows local users to obtain sensitive information by leveraging a new VM.

Record: GHSA-g892-9h8m-r69r
Weakness: CWE-200
Updated: 2026-11-02

OSVPYSEC-2014-97 No score

Libcloud 0.12.3 through 0.13.2 does not set the scrub_data parameter for the destroy DigitalOcean API, which allows local users to obtain sensitive information by leveraging a new VM.

Record: PYSEC-2014-97
Updated: 2026-11-02

Affected products

apache libcloud

Affected packages

Affected packages
Package	Affected	Fixed
`apache-libcloud` PyPI	0.12.3 to 0.13.2	0.13.3
`apache-libcloud` PyPI	0.12.3 up to 0.13.3, plus listed versions 0.12.40.13.00.13.10.13.2	0.13.3

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Apache Libcloud Digital Ocean API - Local Information Disclosure	2014-01-01

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-6480 is a low vulnerability (CVSS 2.1) in Apache Libcloud, published January 7, 2014. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.06%, the 81st percentile. Fixed in apache-libcloud 0.13.3.

References

Show 10 moreShow less