What’s Vulnerable › Vulnerabilities

CVE-2013-4471

• Severity: medium (CVSS 5.5 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2014-05-14 · updated 2026-06-16
• Weakness: CWE-287

Description

The Identity v3 API in OpenStack Dashboard (Horizon) before 2013.2 does not require the current password when changing passwords for user accounts, which makes it easier for remote attackers to change a user password by leveraging the authentication token for that user.

Affected products

• OpenStack Horizon: from 2013.1 before 2013.2 — fixed in 2013.2

How to fix

Upgrade to a fixed version: OpenStack Horizon 2013.2. Check the vendor advisory for mitigations.

References

• http://lists.openstack.org/pipermail/openstack/2013-November/003299.html
• https://bugs.launchpad.net/horizon/+bug/1237989
• http://lists.openstack.org/pipermail/openstack/2013-November/003299.html
• https://bugs.launchpad.net/horizon/+bug/1237989

Get alerted when CVE-2013-4471 or the next vulnerability affects your stack