CVE-2014-0056

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2014-0056
The l3-agent in OpenStack Neutron 2012.2 before 2013.2.3 does not check the tenant id when creating ports, which allows remote authenticated users to plug ports into the routers of arbitrary tenants via the device id in a port-create command.

2.1 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:N/AC:H/Au:S/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector NETWORK

Access Complexity HIGH

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
http://rhn.redhat.com/errata/RHSA-2014-0516.html
http://www.openwall.com/lists/oss-security/2014/03/27/5
http://www.ubuntu.com/usn/USN-2194-1
https://bugs.launchpad.net/neutron/+bug/1243327
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:openstack:neutron:2012.2:*:*:*:*:*:*:*
cpe:2.3:a:openstack:neutron:2012.2.1:*:*:*:*:*:*:*
cpe:2.3:a:openstack:neutron:2012.2.2:*:*:*:*:*:*:*
cpe:2.3:a:openstack:neutron:2012.2.3:*:*:*:*:*:*:*
cpe:2.3:a:openstack:neutron:2012.2.4:*:*:*:*:*:*:*
cpe:2.3:a:openstack:neutron:2013.1:*:*:*:*:*:*:*
cpe:2.3:a:openstack:neutron:2013.1.1:*:*:*:*:*:*:*
cpe:2.3:a:openstack:neutron:2013.1.2:*:*:*:*:*:*:*
cpe:2.3:a:openstack:neutron:2013.1.3:*:*:*:*:*:*:*
cpe:2.3:a:openstack:neutron:2013.1.4:*:*:*:*:*:*:*
cpe:2.3:a:openstack:neutron:2013.1.5:*:*:*:*:*:*:*
cpe:2.3:a:openstack:neutron:2013.2:*:*:*:*:*:*:*
cpe:2.3:a:openstack:neutron:2013.2.1:*:*:*:*:*:*:*
cpe:2.3:a:openstack:neutron:2013.2.2:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*
History

13 Feb 2023, 00:30

Type Values Removed Values Added
References
  • {'url': 'https://access.redhat.com/security/cve/CVE-2014-0056', 'name': 'https://access.redhat.com/security/cve/CVE-2014-0056', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1063141', 'name': 'https://bugzilla.redhat.com/show_bug.cgi?id=1063141', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2014:0516', 'name': 'https://access.redhat.com/errata/RHSA-2014:0516', 'tags': [], 'refsource': 'MISC'}
Summary CVE-2014-0056 openstack-neutron: insufficient authorization checks when creating ports The l3-agent in OpenStack Neutron 2012.2 before 2013.2.3 does not check the tenant id when creating ports, which allows remote authenticated users to plug ports into the routers of arbitrary tenants via the device id in a port-create command.

02 Feb 2023, 16:15

Type Values Removed Values Added
References
  • (MISC) https://access.redhat.com/security/cve/CVE-2014-0056 -
  • (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1063141 -
  • (MISC) https://access.redhat.com/errata/RHSA-2014:0516 -
Summary The l3-agent in OpenStack Neutron 2012.2 before 2013.2.3 does not check the tenant id when creating ports, which allows remote authenticated users to plug ports into the routers of arbitrary tenants via the device id in a port-create command. CVE-2014-0056 openstack-neutron: insufficient authorization checks when creating ports
Information

Published : 2014-05-08 14:29

Updated : 2023-12-10 11:31

NVD link : CVE-2014-0056

Mitre link : CVE-2014-0056

CVE.ORG link : CVE-2014-0056

JSON object : View

Products Affected

canonical

  • ubuntu_linux

openstack

  • neutron
CWE
CWE-287

Improper Authentication