CVE-2012-3360

OpenStack Nova Directory traversal vulnerability

5.5 MediumFix available

CVE-2012-3360 is a medium vulnerability (CVSS 5.5) in Openstack Essex, published July 22, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.08%, the 87th percentile. Fixed in nova 12.0.0a0.

What does this mean?

Severity: 5.5 MediumCVSS 2.0, NVD
Exploit chance: 3.08%EPSS, 87th percentile
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 12.0.0a0nova +3 more

Description

Directory traversal vulnerability in virt/disk/api.py in OpenStack Compute (Nova) Folsom (2012.2) and Essex (2012.1), when used over libvirt-based hypervisors, allows remote authenticated users to write arbitrary files to the disk image via a .. (dot dot) in the path attribute of a file element.

Exploit likelihood

3.08%Up 1.4 points since Feb 4, 2022

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`nova` PyPI	before 12.0.0a0	12.0.0a0
`nova` Debian:12	before 2012.1.1-2	2012.1.1-2
`nova` Debian:13	before 2012.1.1-2	2012.1.1-2
`nova` Debian:14	before 2012.1.1-2	2012.1.1-2

What each source reports

NVD Score used5.5

Record: CVE-2012-3360
CVSS 2.0: 5.5 MediumAV:N/AC:L/Au:S/C:N/I:P/A:P
Weakness: CWE-22
Updated: 2026-11-02

CVE ListNo score

Record: CVE-2012-3360
Updated: 2026-11-02

EUVDEUVD-2012-0021No score

Record: EUVD-2012-0021
Updated: 2026-11-03

GitHub AdvisoriesGHSA-m454-cm7h-rqhhNo score

OpenStack Nova Directory traversal vulnerability

Directory traversal vulnerability in virt/disk/api.py in OpenStack Compute (Nova) Folsom (2012.2) and Essex (2012.1), when used over libvirt-based hypervisors, allows remote authenticated users to write arbitrary files to the disk image via a .. (dot dot) in the path attribute of a file element.

Record: GHSA-m454-cm7h-rqhh
Weakness: CWE-22
Updated: 2026-11-02

OSVNo score