CVE-2014-0056
OpenStack Neutron Improper Authentication vulnerability
The l3-agent in OpenStack Neutron 2012.2 before 2013.2.3 does not check the tenant id when creating ports, which allows remote authenticated users to plug ports into the routers of arbitrary tenants via the device id in a port-create command.
Exploit likelihood
What each source reports
NVD Score used
The l3-agent in OpenStack Neutron 2012.2 before 2013.2.3 does not check the tenant id when creating ports, which allows remote authenticated users to plug ports into the routers of arbitrary tenants via the device id in a port-create command.
- Record
CVE-2014-0056- CVSS 2.0
- 2.1 Low
AV:N/AC:H/Au:S/C:P/I:N/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
The l3-agent in OpenStack Neutron 2012.2 before 2013.2.3 does not check the tenant id when creating ports, which allows remote authenticated users to plug ports into the routers of arbitrary tenants via the device id in a port-create command.
- Record
CVE-2014-0056- Updated
- 2026-11-02
EUVDEUVD-2022-2893 No score
The l3-agent in OpenStack Neutron 2012.2 before 2013.2.3 does not check the tenant id when creating ports, which allows remote authenticated users to plug ports into the routers of arbitrary tenants via the device id in a port-create command.
- Record
EUVD-2022-2893- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-72p9-6gc7-q93r No score
OpenStack Neutron Improper Authentication vulnerability
The l3-agent in OpenStack Neutron 2012.2 before 2013.2.3 does not check the tenant id when creating ports, which allows remote authenticated users to plug ports into the routers of arbitrary tenants via the device id in a port-create command.
- Record
GHSA-72p9-6gc7-q93r- Weakness
- CWE-287
- Updated
- 2026-11-02
OSV No score
The l3-agent in OpenStack Neutron 2012.2 before 2013.2.3 does not check the tenant id when creating ports, which allows remote authenticated users to plug ports into the routers of arbitrary tenants via the device id in a port-create command.
- Record
CVE-2014-0056- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-0056 No score
The l3-agent in OpenStack Neutron 2012.2 before 2013.2.3 does not check the tenant id when creating ports, which allows remote authenticated users to plug ports into the routers of arbitrary tenants via the device id in a port-create command.
- Record
DEBIAN-CVE-2014-0056- Updated
- 2026-11-02
OSVGHSA-72p9-6gc7-q93r No score
OpenStack Neutron Improper Authentication vulnerability
The l3-agent in OpenStack Neutron 2012.2 before 2013.2.3 does not check the tenant id when creating ports, which allows remote authenticated users to plug ports into the routers of arbitrary tenants via the device id in a port-create command.
- Record
GHSA-72p9-6gc7-q93r- Weakness
- CWE-287
- Updated
- 2026-11-02
OSVPYSEC-2026-851 No score
OpenStack Neutron Improper Authentication vulnerability
The l3-agent in OpenStack Neutron 2012.2 before 2013.2.3 does not check the tenant id when creating ports, which allows remote authenticated users to plug ports into the routers of arbitrary tenants via the device id in a port-create command.
- Record
PYSEC-2026-851- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-0056 No score
The l3-agent in OpenStack Neutron 2012.2 before 2013.2.3 does not check the tenant id when creating ports, which allows remote authenticated users to plug ports into the routers of arbitrary tenants via the device id in a port-create command.
- Record
UBUNTU-CVE-2014-0056- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
neutronPyPI |
2012.2 up to 2013.2.3 | 2013.2.3 |
neutronDebian:12 |
before 2013.2.2-4 | 2013.2.2-4 |
neutronDebian:13 |
before 2013.2.2-4 | 2013.2.2-4 |
neutronDebian:14 |
before 2013.2.2-4 | 2013.2.2-4 |
openstack-neutronRed Hat:openstack:4::el6 From an advisory covering 2 CVEs |
before 0:2013.2.3-7.el6ost | 0:2013.2.3-7.el6ost |
openstack-neutron-bigswitchRed Hat:openstack:4::el6 From an advisory covering 2 CVEs |
before 0:2013.2.3-7.el6ost | 0:2013.2.3-7.el6ost |
openstack-neutron-brocadeRed Hat:openstack:4::el6 From an advisory covering 2 CVEs |
before 0:2013.2.3-7.el6ost | 0:2013.2.3-7.el6ost |
openstack-neutron-ciscoRed Hat:openstack:4::el6 From an advisory covering 2 CVEs |
before 0:2013.2.3-7.el6ost | 0:2013.2.3-7.el6ost |
openstack-neutron-hypervRed Hat:openstack:4::el6 From an advisory covering 2 CVEs |
before 0:2013.2.3-7.el6ost | 0:2013.2.3-7.el6ost |
openstack-neutron-linuxbridgeRed Hat:openstack:4::el6 From an advisory covering 2 CVEs |
before 0:2013.2.3-7.el6ost | 0:2013.2.3-7.el6ost |
Show 12 moreShow less
| Package | Affected | Fixed |
|---|---|---|
openstack-neutron-mellanoxRed Hat:openstack:4::el6 From an advisory covering 2 CVEs |
before 0:2013.2.3-7.el6ost | 0:2013.2.3-7.el6ost |
openstack-neutron-metapluginRed Hat:openstack:4::el6 From an advisory covering 2 CVEs |
before 0:2013.2.3-7.el6ost | 0:2013.2.3-7.el6ost |
openstack-neutron-metering-agentRed Hat:openstack:4::el6 From an advisory covering 2 CVEs |
before 0:2013.2.3-7.el6ost | 0:2013.2.3-7.el6ost |
openstack-neutron-midonetRed Hat:openstack:4::el6 From an advisory covering 2 CVEs |
before 0:2013.2.3-7.el6ost | 0:2013.2.3-7.el6ost |
openstack-neutron-ml2Red Hat:openstack:4::el6 From an advisory covering 2 CVEs |
before 0:2013.2.3-7.el6ost | 0:2013.2.3-7.el6ost |
openstack-neutron-necRed Hat:openstack:4::el6 From an advisory covering 2 CVEs |
before 0:2013.2.3-7.el6ost | 0:2013.2.3-7.el6ost |
openstack-neutron-niciraRed Hat:openstack:4::el6 From an advisory covering 2 CVEs |
before 0:2013.2.3-7.el6ost | 0:2013.2.3-7.el6ost |
openstack-neutron-openvswitchRed Hat:openstack:4::el6 From an advisory covering 2 CVEs |
before 0:2013.2.3-7.el6ost | 0:2013.2.3-7.el6ost |
openstack-neutron-plumgridRed Hat:openstack:4::el6 From an advisory covering 2 CVEs |
before 0:2013.2.3-7.el6ost | 0:2013.2.3-7.el6ost |
openstack-neutron-ryuRed Hat:openstack:4::el6 From an advisory covering 2 CVEs |
before 0:2013.2.3-7.el6ost | 0:2013.2.3-7.el6ost |
openstack-neutron-vpn-agentRed Hat:openstack:4::el6 From an advisory covering 2 CVEs |
before 0:2013.2.3-7.el6ost | 0:2013.2.3-7.el6ost |
python-neutronRed Hat:openstack:4::el6 From an advisory covering 2 CVEs |
before 0:2013.2.3-7.el6ost | 0:2013.2.3-7.el6ost |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-0056 is a low vulnerability (CVSS 2.1) in Openstack Neutron, published April 1, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.44%, the 73rd percentile. Fixed in neutron 2013.2.3.
References
openwall.com/lists/oss-security/2014/03/27/5
rhn.redhat.com/errata/RHSA-2014-0516.html
ubuntu.com/usn/USN-2194-1
bugs.launchpad.net/neutron/+bug/1243327
nvd.nist.gov/vuln/detail/CVE-2014-0056
access.redhat.com/errata/RHSA-2014:0516
Show 32 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=1063141
github.com/advisories/GHSA-72p9-6gc7-q93r
security-tracker.debian.org/tracker/CVE-2014-0056
opendev.org/openstack/neutron
pypi.org/project/neutron
security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0516.json
cve.org/CVERecord?id=CVE-2013-6433
ubuntu.com/security/CVE-2014-0056