Every CVE Search/ Get API key

CVE-2012-3447

Arbitrary file overwrite in OpenStack Nova

4.9 MediumFix available

virt/disk/api.py in OpenStack Compute (Nova) 2012.1.x before 2012.1.2 and Folsom before Folsom-3 allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an image that uses a symlink that is only readable by root. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3361.

Exploit likelihood

1.93%Up 0.6 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.9

virt/disk/api.py in OpenStack Compute (Nova) 2012.1.x before 2012.1.2 and Folsom before Folsom-3 allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an image that uses a symlink that is only readable by root. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3361.

Record
CVE-2012-3447
CVSS 2.0
4.9 MediumAV:N/AC:M/Au:S/C:N/I:P/A:P
Weakness
CWE-264
Updated
2026-11-02
CVE List No score

virt/disk/api.py in OpenStack Compute (Nova) 2012.1.x before 2012.1.2 and Folsom before Folsom-3 allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an image that uses a symlink that is only readable by root. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3361.

Record
CVE-2012-3447
Updated
2026-11-02
EUVDEUVD-2012-0018 No score

virt/disk/api.py in OpenStack Compute (Nova) 2012.1.x before 2012.1.2 and Folsom before Folsom-3 allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an image that uses a symlink that is only readable by root. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3361.

Record
EUVD-2012-0018
Updated
2026-11-03
GitHub AdvisoriesGHSA-xc4g-7vw8-924h 7.1

Arbitrary file overwrite in OpenStack Nova

virt/disk/api.py in OpenStack Compute (Nova) 2012.1.x before 2012.1.2 and Folsom before Folsom-3 allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an image that uses a symlink that is only readable by root. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3361.

Record
GHSA-xc4g-7vw8-924h
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-863
Updated
2026-11-02
OSVGHSA-xc4g-7vw8-924h 7.1

Arbitrary file overwrite in OpenStack Nova

virt/disk/api.py in OpenStack Compute (Nova) 2012.1.x before 2012.1.2 and Folsom before Folsom-3 allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an image that uses a symlink that is only readable by root. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3361.

Record
GHSA-xc4g-7vw8-924h
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-863
Updated
2026-11-02
OSV No score

virt/disk/api.py in OpenStack Compute (Nova) 2012.1.x before 2012.1.2 and Folsom before Folsom-3 allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an image that uses a symlink that is only readable by root. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3361.

Record
CVE-2012-3447
Updated
2026-11-02
OSVDEBIAN-CVE-2012-3447 No score

virt/disk/api.py in OpenStack Compute (Nova) 2012.1.x before 2012.1.2 and Folsom before Folsom-3 allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an image that uses a symlink that is only readable by root. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3361.

Record
DEBIAN-CVE-2012-3447
Updated
2026-11-02
OSVPYSEC-2012-21 No score

virt/disk/api.py in OpenStack Compute (Nova) 2012.1.x before 2012.1.2 and Folsom before Folsom-3 allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an image that uses a symlink that is only readable by root. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3361.

Record
PYSEC-2012-21
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nova
PyPI
 before 12.0.0
12.0.0
nova
Debian:12
 before 2012.1.1-6
2012.1.1-6
nova
Debian:13
 before 2012.1.1-6
2012.1.1-6
nova
Debian:14
 before 2012.1.1-6
2012.1.1-6
nova
PyPI
 All versions, plus listed versions
15.1.516.1.616.1.716.1.817.0.10
Show 45 moreShow less
17.0.1117.0.1217.0.1317.0.717.0.817.0.918.0.218.0.318.1.018.2.018.2.118.2.218.2.318.3.019.0.019.0.0.0rc119.0.0.0rc219.0.119.0.219.0.319.1.019.2.019.3.019.3.119.3.220.0.020.0.0.0rc120.0.0.0rc220.0.120.1.020.1.120.2.020.3.020.4.020.4.120.5.020.6.020.6.121.0.021.0.0.0rc121.0.0.0rc221.1.021.1.121.1.221.2.0
 None known

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2012-3447 is a medium vulnerability (CVSS 4.9) in Openstack Folsom, published August 20, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.93%, the 80th percentile. Fixed in nova 12.0.0.

References

Show 8 moreShow less
This page doesn't list everything

Left out here: 107 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open