CVE-2015-7713

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2015-10-29 · updated 2026-06-17
Weakness: CWE-254

Description

OpenStack Compute (Nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) do not properly apply security group changes, which allows remote attackers to bypass intended restriction by leveraging an instance that was running when the change was made.

Affected products

OpenStack Nova: from 2014.2 before 2014.2.4; from 2015.1.0 before 2015.1.2 — fixed in 2014.2.4, 2015.1.2

How to fix

Upgrade to a fixed version: OpenStack Nova 2014.2.4, 2015.1.2. Check the vendor advisory for mitigations.

References

http://rhn.redhat.com/errata/RHSA-2015-2684.html
http://www.securityfocus.com/bid/76960
https://access.redhat.com/errata/RHSA-2015:2673
https://bugs.launchpad.net/nova/+bug/1491307
https://bugs.launchpad.net/nova/+bug/1492961
https://security.openstack.org/ossa/OSSA-2015-021.html
http://rhn.redhat.com/errata/RHSA-2015-2684.html
http://www.securityfocus.com/bid/76960
https://access.redhat.com/errata/RHSA-2015:2673
https://bugs.launchpad.net/nova/+bug/1491307
https://bugs.launchpad.net/nova/+bug/1492961
https://security.openstack.org/ossa/OSSA-2015-021.html

Get alerted when CVE-2015-7713 or the next vulnerability affects your stack