Every CVE Search/ Get API key

CVE-2015-5251

OpenStack Image Service (Glance) allows remote authenticated users to bypass access restrictions

5.5 MediumFix available

CVE-2015-5251 is a medium vulnerability (CVSS 5.5) in Openstack Image Registry And Delivery Service \(glance\), published September 22, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.05%, the 81st percentile. Fixed in glance 2015.1.2.

OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allow remote authenticated users to change the status of their images and bypass access restrictions via the HTTP x-image-meta-status header to images/*.

Exploit likelihood

2.05%Up 1.0 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.5

OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allow remote authenticated users to change the status of their images and bypass access restrictions via the HTTP x-image-meta-status header to images/*.

Record
CVE-2015-5251
CVSS 2.0
5.5 MediumAV:N/AC:L/Au:S/C:N/I:P/A:P
Weakness
CWE-264
Updated
2026-11-02
CVE List No score

OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allow remote authenticated users to change the status of their images and bypass access restrictions via the HTTP x-image-meta-status header to images/*.

Record
CVE-2015-5251
Updated
2026-11-02
EUVDEUVD-2022-4907 No score

OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allow remote authenticated users to change the status of their images and bypass access restrictions via the HTTP x-image-meta-status header to images/*.

Record
EUVD-2022-4907
Updated
2026-11-03
GitHub AdvisoriesGHSA-q748-mcwg-xmqv 5.3

OpenStack Image Service (Glance) allows remote authenticated users to bypass access restrictions

OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allow remote authenticated users to change the status of their images and bypass access restrictions via the HTTP x-image-meta-status header to images/*.

Record
GHSA-q748-mcwg-xmqv
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-863
Updated
2026-11-02
OSVGHSA-q748-mcwg-xmqv 5.3

OpenStack Image Service (Glance) allows remote authenticated users to bypass access restrictions

OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allow remote authenticated users to change the status of their images and bypass access restrictions via the HTTP x-image-meta-status header to images/*.

Record
GHSA-q748-mcwg-xmqv
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-863
Updated
2026-11-02
OSVPYSEC-2026-816 5.3

OpenStack Image Service (Glance) allows remote authenticated users to bypass access restrictions

OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allow remote authenticated users to change the status of their images and bypass access restrictions via the HTTP x-image-meta-status header to images/*.

Record
PYSEC-2026-816
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
Show 5 moreShow less
OSV No score

OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allow remote authenticated users to change the status of their images and bypass access restrictions via the HTTP x-image-meta-status header to images/*.

Record
CVE-2015-5251
Updated
2026-11-02
OSVDEBIAN-CVE-2015-5251 No score

OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allow remote authenticated users to change the status of their images and bypass access restrictions via the HTTP x-image-meta-status header to images/*.

Record
DEBIAN-CVE-2015-5251
Updated
2026-11-02
OSVSUSE-SU-2016:0101-1 No score

Security update for openstack-glance

This update for openstack-glance provides the following fixes:

  • Catch NotAuthenticated exception in import task. (bsc#947735, CVE-2015-5286)
  • Cleanup chunks for deleted image if token expired. (bsc#947735, CVE-2015-5286)
  • Prevent image status being directly modified via v1. (bsc#945994, CVE-2015-5251)
  • Fix error when downloading image status is not active. (bsc#945051)
  • Add ability to deactivate an image.
Record
SUSE-SU-2016:0101-1
Updated
2026-11-02
OSVUBUNTU-CVE-2015-5251 No score

OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allow remote authenticated users to change the status of their images and bypass access restrictions via the HTTP x-image-meta-status header to images/*.

Record
UBUNTU-CVE-2015-5251
Updated
2026-11-02
OSVUSN-3446-1 No score

glance vulnerabilities

Hemanth Makkapati discovered that OpenStack Glance incorrectly handled access restrictions. A remote authenticated user could use this issue to change the status of images, contrary to access restrictions. (CVE-2015-5251)

Mike Fedosin and Alexei Galkin discovered that OpenStack Glance incorrectly handled the storage quota. A remote authenticated user could use this issue to consume disk resources, leading to a denial of service. (CVE-2015-5286)

Erno Kuvaja discovered that OpenStack Glance incorrectly handled the show_multiple_locations option. When show_multiple_locations is enabled, a remote authenticated user could change an image status and upload new image data. (CVE-2016-0757)

Record
USN-3446-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
glance
PyPI
 2015.1.0 up to 2015.1.2
2015.1.2
glance
PyPI
 2011.2 up to 2014.2.4
2014.2.4
glance
Debian:12
 before 1:11.0.0-1
1:11.0.0-1
glance
Debian:13
 before 1:11.0.0-1
1:11.0.0-1
glance
Debian:14
 before 1:11.0.0-1
1:11.0.0-1
glance
PyPI
 2011.2 up to 2014.2.4, 2015.1.0 up to 2015.1.2
2014.2.42015.1.2
openstack-glance
Red Hat:openstack:5::el6
 before 0:2014.1.5-3.el6ost
0:2014.1.5-3.el6ost
openstack-glance-doc
Red Hat:openstack:5::el6
 before 0:2014.1.5-3.el6ost
0:2014.1.5-3.el6ost
python-glance
Red Hat:openstack:5::el6
 before 0:2014.1.5-3.el6ost
0:2014.1.5-3.el6ost
openstack-glance
Red Hat:openstack:5::el7
 before 0:2014.1.5-3.el7ost
0:2014.1.5-3.el7ost
Show 11 moreShow less
Affected packages
PackageAffectedFixed
openstack-glance-doc
Red Hat:openstack:5::el7
 before 0:2014.1.5-3.el7ost
0:2014.1.5-3.el7ost
python-glance
Red Hat:openstack:5::el7
 before 0:2014.1.5-3.el7ost
0:2014.1.5-3.el7ost
openstack-glance
Red Hat:openstack:6::el7
 before 0:2014.2.3-3.el7ost
0:2014.2.3-3.el7ost
openstack-glance-doc
Red Hat:openstack:6::el7
 before 0:2014.2.3-3.el7ost
0:2014.2.3-3.el7ost
python-glance
Red Hat:openstack:6::el7
 before 0:2014.2.3-3.el7ost
0:2014.2.3-3.el7ost
openstack-glance
Red Hat:openstack:7::el7
 before 0:2015.1.1-3.el7ost
0:2015.1.1-3.el7ost
openstack-glance-doc
Red Hat:openstack:7::el7
 before 0:2015.1.1-3.el7ost
0:2015.1.1-3.el7ost
python-glance
Red Hat:openstack:7::el7
 before 0:2015.1.1-3.el7ost
0:2015.1.1-3.el7ost
openstack-glance
SUSE:OpenStack Cloud 5
 before 2014.2.4.juno-14.1
2014.2.4.juno-14.1
openstack-glance-doc
SUSE:OpenStack Cloud 5
 before 2014.2.4.juno-14.1
2014.2.4.juno-14.1
glance
Ubuntu:14.04:LTS
 before 1:2014.1.5-0ubuntu1.1, plus listed versions
1:2013.2~rc2-0ubuntu11:2013.2-0ubuntu11:2014.1~b1-0ubuntu11:2014.1~b2-0ubuntu11:2014.1~b3-0ubuntu2
Show 9 moreShow less
1:2014.1~rc1-0ubuntu11:2014.1~rc2-0ubuntu11:2014.1-0ubuntu11:2014.1.1-0ubuntu21:2014.1.2-0ubuntu11:2014.1.2-0ubuntu1.11:2014.1.3-0ubuntu11:2014.1.4-0ubuntu21:2014.1.5-0ubuntu1
1:2014.1.5-0ubuntu1.1

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 23 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open