CVE-2013-6428
The ReST API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before...
The ReST API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 allows remote authenticated users to bypass the tenant scoping restrictions via a modified tenant_id in the request path.
Exploit likelihood
What each source reports
NVD Score used
The ReST API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 allows remote authenticated users to bypass the tenant scoping restrictions via a modified tenant_id in the request path.
- Record
CVE-2013-6428- CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:N/I:P/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The ReST API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 allows remote authenticated users to bypass the tenant scoping restrictions via a modified tenant_id in the request path.
- Record
CVE-2013-6428- Updated
- 2026-11-02
EUVDEUVD-2013-6240 No score
The ReST API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 allows remote authenticated users to bypass the tenant scoping restrictions via a modified tenant_id in the request path.
- Record
EUVD-2013-6240- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xrx4-52w3-mpjx No score
The ReST API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before...
The ReST API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 allows remote authenticated users to bypass the tenant scoping restrictions via a modified tenant_id in the request path.
- Record
GHSA-xrx4-52w3-mpjx- Updated
- 2026-11-02
OSV No score
The ReST API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 allows remote authenticated users to bypass the tenant scoping restrictions via a modified tenant_id in the request path.
- Record
CVE-2013-6428- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-6428 No score
The ReST API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 allows remote authenticated users to bypass the tenant scoping restrictions via a modified tenant_id in the request path.
- Record
DEBIAN-CVE-2013-6428- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-6428 No score
The ReST API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 allows remote authenticated users to bypass the tenant scoping restrictions via a modified tenant_id in the request path.
- Record
UBUNTU-CVE-2013-6428- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
heatDebian:12 |
before 2013.2.1-1 | 2013.2.1-1 |
heatDebian:13 |
before 2013.2.1-1 | 2013.2.1-1 |
heatDebian:14 |
before 2013.2.1-1 | 2013.2.1-1 |
openstack-heatRed Hat:openstack:4::el6 |
before 0:2013.2.1-4.el6ost | 0:2013.2.1-4.el6ost |
openstack-heat-apiRed Hat:openstack:4::el6 |
before 0:2013.2.1-4.el6ost | 0:2013.2.1-4.el6ost |
openstack-heat-api-cfnRed Hat:openstack:4::el6 |
before 0:2013.2.1-4.el6ost | 0:2013.2.1-4.el6ost |
openstack-heat-api-cloudwatchRed Hat:openstack:4::el6 |
before 0:2013.2.1-4.el6ost | 0:2013.2.1-4.el6ost |
openstack-heat-commonRed Hat:openstack:4::el6 |
before 0:2013.2.1-4.el6ost | 0:2013.2.1-4.el6ost |
openstack-heat-engineRed Hat:openstack:4::el6 |
before 0:2013.2.1-4.el6ost | 0:2013.2.1-4.el6ost |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-6428 is a medium vulnerability (CVSS 4.0) in Openstack Heat, published December 11, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.74%, the 77th percentile. Fixed in heat 2013.2.1-1.
References
launchpad.net/bugs/1256983
rhn.redhat.com/errata/RHSA-2014-0090.html
seclists.org/oss-sec/2013/q4/479
nvd.nist.gov/vuln/detail/CVE-2013-6428
github.com/advisories/GHSA-xrx4-52w3-mpjx
security-tracker.debian.org/tracker/CVE-2013-6428
Show 15 moreShow less
access.redhat.com/errata/RHSA-2014:0090
bugzilla.redhat.com/show_bug.cgi?id=1039141
security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0090.json
cve.org/CVERecord?id=CVE-2013-6426
ubuntu.com/security/CVE-2013-6428
lists.openstack.org/pipermail/openstack-announce/2013-December/000172.html