CVE-2015-8466
Swift3 before 1.9 allows remote attackers to conduct replay attacks via an Authorization request...
CVE-2015-8466 is a high vulnerability (CVSS 7.4) in Openstack Swift3, published January 13, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.01%, the 80th percentile. Fixed in swift-plugin-s3 1.7-5+deb8u1.
Swift3 before 1.9 allows remote attackers to conduct replay attacks via an Authorization request that lacks a Date header.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Swift3 before 1.9 allows remote attackers to conduct replay attacks via an Authorization request that lacks a Date header.
- Record
CVE-2015-8466- CVSS 3.0
- 7.4 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
Swift3 before 1.9 allows remote attackers to conduct replay attacks via an Authorization request that lacks a Date header.
- Record
CVE-2015-8466- Updated
- 2026-11-02
EUVDEUVD-2015-8348 No score
Swift3 before 1.9 allows remote attackers to conduct replay attacks via an Authorization request that lacks a Date header.
- Record
EUVD-2015-8348- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7w5c-h3p4-5gm9
Swift3 before 1.9 allows remote attackers to conduct replay attacks via an Authorization request...
Swift3 before 1.9 allows remote attackers to conduct replay attacks via an Authorization request that lacks a Date header.
- Record
GHSA-7w5c-h3p4-5gm9- CVSS 3.0
- 7.4 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-8466
Swift3 before 1.9 allows remote attackers to conduct replay attacks via an Authorization request that lacks a Date header.
- Record
UBUNTU-CVE-2015-8466- CVSS 3.0
- 7.4 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
swift-plugin-s3Debian:8 |
before 1.7-5+deb8u1, plus listed versions 1.7-5 |
1.7-5+deb8u1 |
swift-plugin-s3Ubuntu:Pro:14.04:LTS |
before 1.7-5+deb8u1build0.14.04.1~esm1, plus listed versions 1.7-21.7-3 |
1.7-5+deb8u1build0.14.04.1~esm1 |
swift-plugin-s3Ubuntu:16.04:LTS |
All versions, plus listed versions 1.8-11.9-11.10-1 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
debian.org/security/2016/dsa-3583
swiftstack.com/docs/admin/release.html
bugs.launchpad.net/swift3/+bug/1497424
github.com/openstack/swift3/blob/master/CHANGELOG
lists.fedoraproject.org/pipermail/package-announce/2015-December/174374.html
nvd.nist.gov/vuln/detail/CVE-2015-8466
ubuntu.com/security/CVE-2015-8466
cve.org/CVERecord?id=CVE-2015-8466