{"id":"CVE-2013-1840","aliases":["DEBIAN-CVE-2013-1840","EUVD-2022-3539","GHSA-c8w9-83vg-r8vv","PYSEC-2013-46","RHSA-2013:0707"],"status":"published","title":"Openstack glance: swift: s3: openstack glance: information disclosure of backend credentials via cached image request","description":"A flaw was found in OpenStack Glance. Remote authenticated users can exploit this vulnerability by requesting a cached image when the single-tenant Swift or S3 store is in use. This action causes the system to report the location field, which can lead to the disclosure of the operator's backend credentials.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.01702,"percentile":0.77382,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-201"],"published":"2013-03-22T21:00:00Z","modified":"2026-10-31T06:00:03Z","fixes":[{"ecosystem":"PyPI","package":"glance","fixed_in":["11.0.0a0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"glance","fixed_in":["2012.1.1-5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"glance","fixed_in":["2012.1.1-5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"glance","fixed_in":["2012.1.1-5"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:2::el6","package":"openstack-glance","fixed_in":["0:2012.2.3-8.el6ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:2::el6","package":"openstack-glance-doc","fixed_in":["0:2012.2.3-8.el6ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:2::el6","package":"python-glance","fixed_in":["0:2012.2.3-8.el6ost"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.0a0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2012.1.1-5"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2012.1.1-5"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2012.1.1-5"}]}]},{"source":"osv","ecosystem":"PyPI","package":"glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.0a0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"v1"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:2::el6","package":"openstack-glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2012.2.3-8.el6ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:2::el6","package":"openstack-glance-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2012.2.3-8.el6ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:2::el6","package":"python-glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2012.2.3-8.el6ost"}]}]}],"products":[{"vendor":"openstack","product":"glance"},{"vendor":"red hat","product":"openstack folsom for rhel 6"},{"vendor":"red hat","product":"red hat openstack platform 16.2"},{"vendor":"red hat","product":"red hat openstack platform 17.1"},{"vendor":"red hat","product":"red hat openstack platform 18.0"}],"references":[{"url":"http://osvdb.org/91304","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0707.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://secunia.com/advisories/52565","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2013/03/14/15","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/58490","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-1764-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2013:0707","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-1840","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugs.launchpad.net/glance/+bug/1135541","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/82878","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"https://review.openstack.org/#/c/24437/","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://review.openstack.org/#/c/24438/","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://review.openstack.org/#/c/24439/","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-1840","tags":["advisory"]},{"url":"https://github.com/openstack/glance/commit/74b067df9726f9cf3e6e17e248719794a6ee0745","tags":["web"]},{"url":"https://github.com/openstack/glance/commit/dd849a9be540bedd4fd904cc0b86ccd9c3e34af2","tags":["web"]},{"url":"https://github.com/openstack/glance/commit/e75764eee34915f8bc5b664ac18e47a556c9d3dd","tags":["web"]},{"url":"https://review.openstack.org/#/c/24437","tags":["web"]},{"url":"https://review.openstack.org/#/c/24438","tags":["web"]},{"url":"https://review.openstack.org/#/c/24439","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/glance/PYSEC-2013-46.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-c8w9-83vg-r8vv","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-1840","tags":["advisory"]},{"url":"https://github.com/openstack/glance","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=888077","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=915445","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=917059","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=920393","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=923395","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0707.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-1840","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2013-1840","title":"Openstack glance: swift: s3: openstack glance: information disclosure of backend credentials via cached image request","description":"A flaw was found in OpenStack Glance. Remote authenticated users can exploit this vulnerability by requesting a cached image when the single-tenant Swift or S3 store is in use. This action causes the system to report the location field, which can lead to the disclosure of the operator's backend credentials.","status":"published","published":"2013-03-22T21:00:00Z","modified":"2026-10-30T18:03:59.725Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-201"],"updated_at":"2026-11-02T14:34:58.534075Z"}],"euvd":[{"id":"EUVD-2022-3539","description":"A flaw was found in OpenStack Glance. Remote authenticated users can exploit this vulnerability by requesting a cached image when the single-tenant Swift or S3 store is in use. This action causes the system to report the location field, which can lead to the disclosure of the operator's backend credentials.","status":"published","published":"2013-03-22T21:00:00Z","modified":"2026-10-30T18:03:59Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:59:03.071815Z"}],"ghsa":[{"id":"GHSA-c8w9-83vg-r8vv","title":"OpenStack Glance is vulnerable to Exposure of Sensitive Information","description":"The v1 API in OpenStack Glance Essex (2012.1), Folsom (2012.2), and Grizzly, when using the single-tenant Swift or S3 store, reports the location field, which allows remote authenticated users to obtain the operator's backend credentials via a request for a cached image.","status":"published","published":"2022-05-17T01:36:25Z","modified":"2026-06-05T17:53:57Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:40:17.745826Z"}],"nvd":[{"id":"CVE-2013-1840","description":"A flaw was found in OpenStack Glance. Remote authenticated users can exploit this vulnerability by requesting a cached image when the single-tenant Swift or S3 store is in use. This action causes the system to report the location field, which can lead to the disclosure of the operator's backend credentials.","status":"published","published":"2013-03-22T21:55:01.487Z","modified":"2026-10-30T19:17:27.123Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-201","CWE-200"],"updated_at":"2026-11-02T14:02:24.091325Z"}],"osv":[{"id":"DEBIAN-CVE-2013-1840","description":"A flaw was found in OpenStack Glance. Remote authenticated users can exploit this vulnerability by requesting a cached image when the single-tenant Swift or S3 store is in use. This action causes the system to report the location field, which can lead to the disclosure of the operator's backend credentials.","status":"published","published":"2013-03-22T21:55:01.487Z","modified":"2026-10-31T06:00:03.280709219Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:25.514579Z"},{"id":"CVE-2013-1840","description":"The v1 API in OpenStack Glance Essex (2012.1), Folsom (2012.2), and Grizzly, when using the single-tenant Swift or S3 store, reports the location field, which allows remote authenticated users to obtain the operator's backend credentials via a request for a cached image.","status":"published","published":"2013-03-22T21:55:01Z","modified":"2026-05-20T08:11:22.511757417Z","updated_at":"2026-11-02T15:43:58.802805Z"},{"id":"GHSA-c8w9-83vg-r8vv","title":"OpenStack Glance is vulnerable to Exposure of Sensitive Information","description":"The v1 API in OpenStack Glance Essex (2012.1), Folsom (2012.2), and Grizzly, when using the single-tenant Swift or S3 store, reports the location field, which allows remote authenticated users to obtain the operator's backend credentials via a request for a cached image.","status":"published","published":"2022-05-17T01:36:25Z","modified":"2026-06-05T18:00:16.802674037Z","cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:44.927642Z"},{"id":"PYSEC-2013-46","description":"The v1 API in OpenStack Glance Essex (2012.1), Folsom (2012.2), and Grizzly, when using the single-tenant Swift or S3 store, reports the location field, which allows remote authenticated users to obtain the operator's backend credentials via a request for a cached image.","status":"published","published":"2013-03-22T21:55:01.487Z","modified":"2026-06-10T17:01:19.387374557Z","updated_at":"2026-11-02T15:52:51.645172Z"},{"id":"RHSA-2013:0707","title":"Red Hat Security Advisory: openstack-glance security and bug fix update","status":"published","published":"2024-09-15T20:43:04Z","modified":"2025-11-22T10:43:33Z","updated_at":"2026-11-02T15:53:01.993625Z"}]}}