CVE-2015-5251

Severity: medium (CVSS 5.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2015-10-26 · updated 2026-06-17
Weakness: CWE-264

Description

OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allow remote authenticated users to change the status of their images and bypass access restrictions via the HTTP x-image-meta-status header to images/*.

Affected products

OpenStack Image Registry And Delivery Service (Glance): through 2014.2.3; 2015.1.0, 2015.1.1

References

http://rhn.redhat.com/errata/RHSA-2015-1897.html
https://bugs.launchpad.net/bugs/1482371
https://security.openstack.org/ossa/OSSA-2015-019.html
http://rhn.redhat.com/errata/RHSA-2015-1897.html
https://bugs.launchpad.net/bugs/1482371
https://security.openstack.org/ossa/OSSA-2015-019.html

Get alerted when CVE-2015-5251 or the next vulnerability affects your stack