{"id":"CVE-2013-6480","aliases":["EUVD-2014-0003","GHSA-g892-9h8m-r69r","PYSEC-2014-97"],"status":"published","title":"Libcloud does not properly scrub data when destroying a DigitalOcean node","description":"Libcloud 0.12.3 through 0.13.2 does not set the scrub_data parameter for the destroy DigitalOcean API, which allows local users to obtain sensitive information by leveraging a new VM.","severity":{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.0206,"percentile":0.81448,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-200"],"published":"2014-01-07T18:00:00Z","modified":"2026-06-17T00:00:34Z","exploits":[{"source":"exploitdb","id":"EDB-38937","title":"Apache Libcloud Digital Ocean API - Local Information Disclosure","type":"local","platform":"linux","date":"2014-01-01","verified":true,"url":"https://www.exploit-db.com/exploits/38937"}],"fixes":[{"ecosystem":"PyPI","package":"apache-libcloud","fixed_in":["0.13.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"apache-libcloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.12.3"},{"last_affected":"0.13.2"},{"fixed":"0.13.3"}]}]},{"source":"osv","ecosystem":"PyPI","package":"apache-libcloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.12.3"},{"fixed":"0.13.3"}]}],"versions":["0.12.3","0.12.4","0.13.0","0.13.1","0.13.2"]},{"source":"osv","ecosystem":"PyPI","package":"apache-libcloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.12.3"},{"fixed":"0.13.3"}]}],"versions":["0.12.3","0.12.4","0.13.0","0.13.1","0.13.2"]}],"products":[{"vendor":"apache","product":"libcloud"}],"references":[{"url":"http://www.securityfocus.com/bid/64617","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://libcloud.apache.org/security.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"http://www.securityfocus.com/archive/1/530624/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"https://digitalocean.com/blog_posts/transparency-regarding-data-security","tags":["x_refsource_MISC","x_transferred","article"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-02/msg00015.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://github.com/fog/fog/issues/2525","tags":["x_refsource_MISC","x_transferred","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-6480","tags":["advisory"]},{"url":"https://github.com/apache/libcloud/commit/4449e165a00756dc61430e6ad9520f005b045d29","tags":["web"]},{"url":"https://github.com/apache/libcloud/blob/abba8c1719a8bda6db8efde2d46fd1b423ae4304/CHANGES.rst#compute-48","tags":["web"]},{"url":"https://issues.apache.org/jira/browse/LIBCLOUD-487","tags":["web"]},{"url":"https://web.archive.org/web/20131230232003/https://digitalocean.com/blog_posts/transparency-regarding-data-security","tags":["web"]},{"url":"https://web.archive.org/web/20140129025443/http://www.securityfocus.com/bid/64617","tags":["web"]},{"url":"https://web.archive.org/web/20201209074449/http://www.securityfocus.com/archive/1/530624/100/0/threaded","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/apache-libcloud/PYSEC-2014-97.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-g892-9h8m-r69r","tags":["advisory"]},{"url":"https://github.com/apache/libcloud","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2013-6480","description":"Libcloud 0.12.3 through 0.13.2 does not set the scrub_data parameter for the destroy DigitalOcean API, which allows local users to obtain sensitive information by leveraging a new VM.","status":"published","published":"2014-01-07T18:00:00Z","modified":"2024-08-06T17:39:01.324Z","updated_at":"2026-11-02T14:34:57.499208Z"}],"euvd":[{"id":"EUVD-2014-0003","description":"Libcloud 0.12.3 through 0.13.2 does not set the scrub_data parameter for the destroy DigitalOcean API, which allows local users to obtain sensitive information by leveraging a new VM.","status":"published","published":"2014-01-07T18:00:00Z","modified":"2024-08-06T17:39:01Z","updated_at":"2026-11-03T01:56:26.306678Z"}],"ghsa":[{"id":"GHSA-g892-9h8m-r69r","title":"Libcloud does not properly scrub data when destroying a DigitalOcean node","description":"Libcloud 0.12.3 through 0.13.2 does not set the `scrub_data parameter` for the destroy DigitalOcean API, which allows local users to obtain sensitive information by leveraging a new VM.","status":"published","published":"2022-05-14T02:54:05Z","modified":"2024-09-06T15:40:07Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:38:01.080229Z"}],"nvd":[{"id":"CVE-2013-6480","description":"Libcloud 0.12.3 through 0.13.2 does not set the scrub_data parameter for the destroy DigitalOcean API, which allows local users to obtain sensitive information by leveraging a new VM.","status":"published","published":"2014-01-07T18:55:07.083Z","modified":"2026-06-17T00:00:34.127Z","cvss":[{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:02:48.062712Z"}],"osv":[{"id":"GHSA-g892-9h8m-r69r","title":"Libcloud does not properly scrub data when destroying a DigitalOcean node","description":"Libcloud 0.12.3 through 0.13.2 does not set the `scrub_data parameter` for the destroy DigitalOcean API, which allows local users to obtain sensitive information by leveraging a new VM.","status":"published","published":"2022-05-14T02:54:05Z","modified":"2024-12-08T05:31:24.36739Z","cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:47.472172Z"},{"id":"PYSEC-2014-97","description":"Libcloud 0.12.3 through 0.13.2 does not set the scrub_data parameter for the destroy DigitalOcean API, which allows local users to obtain sensitive information by leveraging a new VM.","status":"published","published":"2014-01-07T18:55:00Z","modified":"2026-06-10T17:00:32.937768878Z","updated_at":"2026-11-02T15:52:51.645172Z"}]}}