CVE-2013-4183
OpenStack Cinder LVMVolumeDriver does not zero deleted snapshots
CVE-2013-4183 is a low vulnerability (CVSS 2.1) in Openstack Cinder, published September 16, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. Fixed in cinder 7.0.0a0.
- Severity
- 2.1 LowCVSS 2.0, NVD
- Exploit chance
- 0.41%EPSS, 35th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
7.0.0a0cinder +6 more
Description
The clear_volume function in LVMVolumeDriver driver in OpenStack Cinder 2013.1.1 through 2013.1.2 does not properly clear data when deleting a snapshot, which allows local users to obtain sensitive information via unspecified vectors.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cinderPyPI | before 7.0.0a0 | 7.0.0a0 |
cinderDebian:12 | before 2013.1.2-4 | 2013.1.2-4 |
cinderDebian:13 | before 2013.1.2-4 | 2013.1.2-4 |
cinderDebian:14 | before 2013.1.2-4 | 2013.1.2-4 |
openstack-cinderRed Hat:openstack:3::el6 From an advisory covering 2 CVEs | before 0:2013.1.3-2.el6ost | 0:2013.1.3-2.el6ost |
openstack-cinder-docRed Hat:openstack:3::el6 From an advisory covering 2 CVEs | before 0:2013.1.3-2.el6ost | 0:2013.1.3-2.el6ost |
python-cinderRed Hat:openstack:3::el6 From an advisory covering 2 CVEs | before 0:2013.1.3-2.el6ost | 0:2013.1.3-2.el6ost |
What each source reports
NVD Score used
The clear_volume function in LVMVolumeDriver driver in OpenStack Cinder 2013.1.1 through 2013.1.2 does not properly clear data when deleting a snapshot, which allows local users to obtain sensitive information via unspecified vectors.
- Record
CVE-2013-4183- CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE ListNo score
The clear_volume function in LVMVolumeDriver driver in OpenStack Cinder 2013.1.1 through 2013.1.2 does not properly clear data when deleting a snapshot, which allows local users to obtain sensitive information via unspecified vectors.
- Record
CVE-2013-4183- Updated
- 2026-11-02
EUVDEUVD-2013-0003No score
The clear_volume function in LVMVolumeDriver driver in OpenStack Cinder 2013.1.1 through 2013.1.2 does not properly clear data when deleting a snapshot, which allows local users to obtain sensitive information via unspecified vectors.
- Record
EUVD-2013-0003- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q3rw-wcj6-8cjf
OpenStack Cinder LVMVolumeDriver does not zero deleted snapshots
The clear_volume function in LVMVolumeDriver driver in OpenStack Cinder 2013.1.1 through 2013.1.2 does not properly clear data when deleting a snapshot, which allows local users to obtain sensitive information via unspecified vectors.
- Record
GHSA-q3rw-wcj6-8cjf- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-q3rw-wcj6-8cjf
OpenStack Cinder LVMVolumeDriver does not zero deleted snapshots
The clear_volume function in LVMVolumeDriver driver in OpenStack Cinder 2013.1.1 through 2013.1.2 does not properly clear data when deleting a snapshot, which allows local users to obtain sensitive information via unspecified vectors.
- Record
GHSA-q3rw-wcj6-8cjf- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVNo score
The clear_volume function in LVMVolumeDriver driver in OpenStack Cinder 2013.1.1 through 2013.1.2 does not properly clear data when deleting a snapshot, which allows local users to obtain sensitive information via unspecified vectors.
- Record
CVE-2013-4183- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-4183No score
The clear_volume function in LVMVolumeDriver driver in OpenStack Cinder 2013.1.1 through 2013.1.2 does not properly clear data when deleting a snapshot, which allows local users to obtain sensitive information via unspecified vectors.
- Record
DEBIAN-CVE-2013-4183- Updated
- 2026-11-02
OSVPYSEC-2013-35No score
The clear_volume function in LVMVolumeDriver driver in OpenStack Cinder 2013.1.1 through 2013.1.2 does not properly clear data when deleting a snapshot, which allows local users to obtain sensitive information via unspecified vectors.
- Record
PYSEC-2013-35- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
rhn.redhat.com/errata/RHSA-2013-1198.html
bugs.launchpad.net/cinder/+bug/1198185
ubuntu.com/usn/USN-2005-1
nvd.nist.gov/vuln/detail/CVE-2013-4183
github.com/openstack/cinder/commit/0ee31073c5cb432a9cdd2648e99aa802b0ed0a17
Show 16 moreShow less
security-tracker.debian.org/tracker/CVE-2013-4183
access.redhat.com/errata/RHSA-2013:1198
bugzilla.redhat.com/show_bug.cgi?id=975916
security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1198.json
cve.org/CVERecord?id=CVE-2013-4183