What’s Vulnerable › Vulnerabilities

CVE-2013-0266: Puppetlabs-cinder: packstack: openstack: puppetlabs-cinder: information disclosure of openstack administrative passwords due to world-readable configuration files.

• Severity: low (CVSS 2.1 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2013-03-08 · updated 2026-10-30
• Weakness: CWE-276

Description

A flaw was found in the `puppetlabs-cinder` module, as used in PackStack. This vulnerability is due to incorrect file permissions, specifically world-readable permissions, on the `cinder.conf` and `api-paste.ini` configuration files. A local user can exploit this by reading these files, which leads to the disclosure of OpenStack administrative passwords. This information disclosure could allow unauthorized access to sensitive OpenStack resources.

Affected products

• OpenStack Essex: all versions
• OpenStack Folsom: all versions
• Red Hat OpenStack Folsom for RHEL 6: all versions — fixed in 0:2012.2.2-1.0.dev408.el6ost
• Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse): all versions
• Red Hat OpenStack Platform 4: all versions

How to fix

Upgrade to a fixed version: Red Hat OpenStack Folsom for RHEL 6 0:2012.2.2-1.0.dev408.el6ost. Check the vendor advisory for mitigations.

References

• http://rhn.redhat.com/errata/RHSA-2013-0595.html
• https://access.redhat.com/errata/RHSA-2013:0595
• https://access.redhat.com/security/cve/CVE-2013-0266
• https://bugzilla.redhat.com/show_bug.cgi?id=908581
• https://github.com/puppetlabs/puppetlabs-cinder/commit/7da792fbd40c0e6eae1ee093aa00e0b177bd2ebc
• http://rhn.redhat.com/errata/RHSA-2013-0595.html
• https://bugzilla.redhat.com/show_bug.cgi?id=908581
• https://github.com/puppetlabs/puppetlabs-cinder/commit/7da792fbd40c0e6eae1ee093aa00e0b177bd2ebc

Get alerted when CVE-2013-0266 or the next vulnerability affects your stack