CVE-2024-40767

Katalog CVE

CVSS 6.5 · Medium EPSS 0,95%

Kerentanan Files or Directories Accessible to External Parties pada openstack nova. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing file path or VMDK flat image with a descriptor file path, an authenticated user may convince systems to return a copy of the referenced file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Nova deployments are affected. NOTE: this issue exists because of an incomplete fix for CVE-2022-47951 and CVE-2024-32498.

Rincian

Terbit di NVD

24 Juli 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-552: Files or Directories Accessible to External Parties

EPSS (30 hari)

0,95% peluang dieksploitasi; lebih tinggi dari 60,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://security.openstack.org advisory vendor
• https://security.openstack.org/ossa/OSSA-2024-002.html advisory vendor
• https://launchpad.net/bugs/2071734 exploit · issue tracking
• https://www.openwall.com/lists/oss-security/2024/07/23/2 mailing list
• https://lists.debian.org/debian-lts-announce/2024/09/msg00017.html