Every CVE Search/ Get API key

CVE-2013-2256

OpenStack Compute (Nova) allows remote authenticated users to obtain sensitive information

6.0 MediumFix available

CVE-2013-2256 is a medium vulnerability (CVSS 6.0) in Openstack Nova, published September 16, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.84%, the 79th percentile. Fixed in nova 2013.1.3.

OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-2 does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to obtain sensitive information (flavor properties), boot arbitrary flavors, and possibly have other unspecified impacts by guessing the flavor id.

Exploit likelihood

1.84%Up 0.8 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 6.0

OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-2 does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to obtain sensitive information (flavor properties), boot arbitrary flavors, and possibly have other unspecified impacts by guessing the flavor id.

Record
CVE-2013-2256
CVSS 2.0
6.0 MediumAV:N/AC:M/Au:S/C:P/I:P/A:P
Weakness
CWE-264
Updated
2026-11-02
CVE List No score

OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-2 does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to obtain sensitive information (flavor properties), boot arbitrary flavors, and possibly have other unspecified impacts by guessing the flavor id.

Record
CVE-2013-2256
Updated
2026-11-02
EUVDEUVD-2022-2621 No score

OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-2 does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to obtain sensitive information (flavor properties), boot arbitrary flavors, and possibly have other unspecified impacts by guessing the flavor id.

Record
EUVD-2022-2621
Updated
2026-11-03
GitHub AdvisoriesGHSA-5mj6-643f-2g85 No score

OpenStack Compute (Nova) allows remote authenticated users to obtain sensitive information

OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-2 does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to obtain sensitive information (flavor properties), boot arbitrary flavors, and possibly have other unspecified impacts by guessing the flavor id.

Record
GHSA-5mj6-643f-2g85
Updated
2026-11-02
OSV No score

OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-2 does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to obtain sensitive information (flavor properties), boot arbitrary flavors, and possibly have other unspecified impacts by guessing the flavor id.

Record
CVE-2013-2256
Updated
2026-11-02
OSVDEBIAN-CVE-2013-2256 No score

OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-2 does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to obtain sensitive information (flavor properties), boot arbitrary flavors, and possibly have other unspecified impacts by guessing the flavor id.

Record
DEBIAN-CVE-2013-2256
Updated
2026-11-02
OSVGHSA-5mj6-643f-2g85 No score

OpenStack Compute (Nova) allows remote authenticated users to obtain sensitive information

OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-2 does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to obtain sensitive information (flavor properties), boot arbitrary flavors, and possibly have other unspecified impacts by guessing the flavor id.

Record
GHSA-5mj6-643f-2g85
Updated
2026-11-02
OSVPYSEC-2026-866 No score

OpenStack Compute (Nova) allows remote authenticated users to obtain sensitive information

OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-2 does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to obtain sensitive information (flavor properties), boot arbitrary flavors, and possibly have other unspecified impacts by guessing the flavor id.

Record
PYSEC-2026-866
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nova
PyPI
 before 2013.1.3
2013.1.3
nova
Debian:12
 before 2013.1.2-3
2013.1.2-3
nova
Debian:13
 before 2013.1.2-3
2013.1.2-3
nova
Debian:14
 before 2013.1.2-3
2013.1.2-3
nova
PyPI
 before 2013.1.3, plus listed versions
15.1.516.1.616.1.716.1.817.0.10
Show 45 moreShow less
17.0.1117.0.1217.0.1317.0.717.0.817.0.918.0.218.0.318.1.018.2.018.2.118.2.218.2.318.3.019.0.019.0.0.0rc119.0.0.0rc219.0.119.0.219.0.319.1.019.2.019.3.019.3.119.3.220.0.020.0.0.0rc120.0.0.0rc220.0.120.1.020.1.120.2.020.3.020.4.020.4.120.5.020.6.020.6.121.0.021.0.0.0rc121.0.0.0rc221.1.021.1.121.1.221.2.0
2013.1.3
openstack-nova
Red Hat:openstack:3::el6
 before 0:2013.1.3-3.el6ost
0:2013.1.3-3.el6ost
openstack-nova-api
Red Hat:openstack:3::el6
 before 0:2013.1.3-3.el6ost
0:2013.1.3-3.el6ost
openstack-nova-cells
Red Hat:openstack:3::el6
 before 0:2013.1.3-3.el6ost
0:2013.1.3-3.el6ost
openstack-nova-cert
Red Hat:openstack:3::el6
 before 0:2013.1.3-3.el6ost
0:2013.1.3-3.el6ost
openstack-nova-common
Red Hat:openstack:3::el6
 before 0:2013.1.3-3.el6ost
0:2013.1.3-3.el6ost
Show 8 moreShow less
Affected packages
PackageAffectedFixed
openstack-nova-compute
Red Hat:openstack:3::el6
 before 0:2013.1.3-3.el6ost
0:2013.1.3-3.el6ost
openstack-nova-conductor
Red Hat:openstack:3::el6
 before 0:2013.1.3-3.el6ost
0:2013.1.3-3.el6ost
openstack-nova-console
Red Hat:openstack:3::el6
 before 0:2013.1.3-3.el6ost
0:2013.1.3-3.el6ost
openstack-nova-doc
Red Hat:openstack:3::el6
 before 0:2013.1.3-3.el6ost
0:2013.1.3-3.el6ost
openstack-nova-network
Red Hat:openstack:3::el6
 before 0:2013.1.3-3.el6ost
0:2013.1.3-3.el6ost
openstack-nova-objectstore
Red Hat:openstack:3::el6
 before 0:2013.1.3-3.el6ost
0:2013.1.3-3.el6ost
openstack-nova-scheduler
Red Hat:openstack:3::el6
 before 0:2013.1.3-3.el6ost
0:2013.1.3-3.el6ost
python-nova
Red Hat:openstack:3::el6
 before 0:2013.1.3-3.el6ost
0:2013.1.3-3.el6ost

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 26 moreShow less
This page doesn't list everything

Left out here: 93 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open