CVE-2016-4383
The glance-manage db in all versions of HPE Helion Openstack Glance allows deleted image ids to...
The glance-manage db in all versions of HPE Helion Openstack Glance allows deleted image ids to be reassigned, which allows remote authenticated users to cause other users to boot into a modified image without notification of the change.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The glance-manage db in all versions of HPE Helion Openstack Glance allows deleted image ids to be reassigned, which allows remote authenticated users to cause other users to boot into a modified image without notification of the change.
- Record
CVE-2016-4383- CVSS 3.0
- 8.4 High
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H - CVSS 2.0
- 8.5 High
AV:N/AC:M/Au:S/C:C/I:C/A:C - Weakness
- CWE-284
- Updated
- 2026-11-02
CVE List No score
The glance-manage db in all versions of HPE Helion Openstack Glance allows deleted image ids to be reassigned, which allows remote authenticated users to cause other users to boot into a modified image without notification of the change.
- Record
CVE-2016-4383- Updated
- 2026-11-02
EUVDEUVD-2016-5383 No score
The glance-manage db in all versions of HPE Helion Openstack Glance allows deleted image ids to be reassigned, which allows remote authenticated users to cause other users to boot into a modified image without notification of the change.
- Record
EUVD-2016-5383- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9hm8-vxr3-42xr
The glance-manage db in all versions of HPE Helion Openstack Glance allows deleted image ids to...
The glance-manage db in all versions of HPE Helion Openstack Glance allows deleted image ids to be reassigned, which allows remote authenticated users to cause other users to boot into a modified image without notification of the change.
- Record
GHSA-9hm8-vxr3-42xr- CVSS 3.0
- 8.4 High
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-284
- Updated
- 2026-11-02
OSV
The glance-manage db in all versions of HPE Helion Openstack Glance allows deleted image ids to be reassigned, which allows remote authenticated users to cause other users to boot into a modified image without notification of the change.
- Record
CVE-2016-4383- CVSS 3.0
- 8.4 High
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-4383
The glance-manage db in all versions of HPE Helion Openstack Glance allows deleted image ids to be reassigned, which allows remote authenticated users to cause other users to boot into a modified image without notification of the change.
- Record
DEBIAN-CVE-2016-4383- CVSS 3.0
- 8.4 High
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-4383
The glance-manage db in all versions of HPE Helion Openstack Glance allows deleted image ids to be reassigned, which allows remote authenticated users to cause other users to boot into a modified image without notification of the change.
- Record
UBUNTU-CVE-2016-4383- CVSS 3.0
- 8.4 High
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
glanceDebian:12 |
All versions, plus listed versions 2:25.1.0-22:25.1.0-2+deb12u12:25.1.0-2+deb12u22:25.1.0-2+deb12u32:25.1.0-2+deb12u5 Show 45 moreShow less2:26.0.0-12:26.0.0-22:26.0.0-32:26.0.0-42:26.0.0~rc1-12:27.0.0-12:27.0.0-22:27.0.0~rc1-12:28.0.0~rc1-12:28.0.1-12:28.0.1-22:28.0.1-32:28.0.1-3+deb12u12:28.0.1-42:29.0.0-12:29.0.0-22:29.0.0-32:29.0.0-42:29.0.0~rc1-12:29.0.0~rc1-22:30.0.0-12:30.0.0-32:30.0.0~rc1-12:30.0.0~rc1-22:31.0.0-12:31.0.0-22:31.0.0-32:31.0.0-42:31.0.0~rc1-12:31.0.0~rc1-22:32.0.0-12:32.0.0-22:32.0.0-32:32.0.0-42:32.0.0~rc1-12:32.0.0~rc1-22:32.0.0~rc1-32:32.0.0~rc1-42:32.0.0~rc2-12:32.0.0~rc2-22:33.0.0-12:33.0.0-22:33.0.0-32:33.0.0-42:33.0.0-5 |
None known |
glanceDebian:13 |
All versions, plus listed versions 2:30.0.0-32:30.0.0-3+deb13u12:30.0.0-3+deb13u22:31.0.0-12:31.0.0-2 Show 23 moreShow less2:31.0.0-32:31.0.0-42:31.0.0~rc1-12:31.0.0~rc1-22:32.0.0-12:32.0.0-22:32.0.0-32:32.0.0-42:32.0.0~rc1-12:32.0.0~rc1-22:32.0.0~rc1-32:32.0.0~rc1-42:32.0.0~rc2-12:32.0.0~rc2-22:33.0.0-12:33.0.0-22:33.0.0-32:33.0.0-42:33.0.0-52:33.0.0-62:33.0.0~rc1-12:33.0.0~rc1-22:33.0.0~rc1-3 |
None known |
glanceDebian:14 |
All versions, plus listed versions 2:30.0.0-32:31.0.0-12:31.0.0-22:31.0.0-32:31.0.0-4 Show 21 moreShow less2:31.0.0~rc1-12:31.0.0~rc1-22:32.0.0-12:32.0.0-22:32.0.0-32:32.0.0-42:32.0.0~rc1-12:32.0.0~rc1-22:32.0.0~rc1-32:32.0.0~rc1-42:32.0.0~rc2-12:32.0.0~rc2-22:33.0.0-12:33.0.0-22:33.0.0-32:33.0.0-42:33.0.0-52:33.0.0-62:33.0.0~rc1-12:33.0.0~rc1-22:33.0.0~rc1-3 |
None known |
glanceUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2:11.0.0-0ubuntu12:12.0.0~b1-0ubuntu12:12.0.0~b2-0ubuntu12:12.0.0~b3-0ubuntu12:12.0.0~rc1-0ubuntu12:12.0.0-0ubuntu12:12.0.0-0ubuntu22:12.0.0-0ubuntu2+esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-4383 is a high vulnerability (CVSS 8.4) in Hp Helion Openstack Glance, published June 27, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.74%, the 86th percentile. No source names a fixed version.
References
securityfocus.com/bid/93106
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05273584
wiki.openstack.org/wiki/OSSN/OSSN-0075
bugs.launchpad.net/glance/+bug/1593799
nvd.nist.gov/vuln/detail/CVE-2016-4383
github.com/advisories/GHSA-9hm8-vxr3-42xr
security-tracker.debian.org/tracker/CVE-2016-4383
ubuntu.com/security/CVE-2016-4383
cve.org/CVERecord?id=CVE-2016-4383
Left out here: 4 versions. The JSON record has them.