CVE-2013-4428

OpenStack Image Registry and Delivery Service (Glance) Folsom, Grizzly before 2013.1.4, and...

3.5 LowFix available

OpenStack Image Registry and Delivery Service (Glance) Folsom, Grizzly before 2013.1.4, and Havana before 2013.2, when the download_image policy is configured, does not properly restrict access to cached images, which allows remote authenticated users to read otherwise restricted images via an image UUID.

Exploit likelihood

3.08%Up 1.4 points since Feb 4, 2022

What each source reports

NVD Score used 3.5

Record: CVE-2013-4428
CVSS 2.0: 3.5 LowAV:N/AC:M/Au:S/C:P/I:N/A:N
Weakness: CWE-264
Updated: 2026-11-02

CVE List No score

Record: CVE-2013-4428
Updated: 2026-11-02

EUVDEUVD-2013-4305 No score

Record: EUVD-2013-4305
Updated: 2026-11-03

GitHub AdvisoriesGHSA-hv7x-f537-wh3x No score

OpenStack Image Registry and Delivery Service (Glance) Folsom, Grizzly before 2013.1.4, and...

Record: GHSA-hv7x-f537-wh3x
Updated: 2026-11-02

OSV No score

Record: CVE-2013-4428
Updated: 2026-11-02

OSVDEBIAN-CVE-2013-4428 No score

Record: DEBIAN-CVE-2013-4428
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`glance` Debian:12	before 2013.2-1	2013.2-1
`glance` Debian:13	before 2013.2-1	2013.2-1
`glance` Debian:14	before 2013.2-1	2013.2-1
`openstack-glance` Red Hat:openstack:3::el6	before 0:2013.1.4-1.el6ost	0:2013.1.4-1.el6ost
`openstack-glance-doc` Red Hat:openstack:3::el6	before 0:2013.1.4-1.el6ost	0:2013.1.4-1.el6ost
`python-glance` Red Hat:openstack:3::el6	before 0:2013.1.4-1.el6ost	0:2013.1.4-1.el6ost

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-4428 is a low vulnerability (CVSS 3.5) in Openstack Glance, published October 27, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.08%, the 87th percentile. Fixed in glance 2013.2-1.

References

Show 12 moreShow less