Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-ruvh-knrw-pygu
Summary
OpenStack Glance Server-Side Request Forgery (SSRF)
An SSRF issue was discovered in OpenStack Glance before Newton. The 'copy_from' feature in the Image Service API v1 allowed an attacker to perform masked network port scans. With v1, it is possible to create images with a URL such as 'http://localhost:22'. This could then allow an attacker to enumerate internal network details while appearing masked, since the scan would appear to originate from the Glance Image service.
Aliases
0
alias CVE-2017-7200
1
alias GHSA-j6mr-cm6x-h6jg
Fixed_packages
0
url pkg:deb/debian/glance@2:13.0.0-1?distro=trixie
purl pkg:deb/debian/glance@2:13.0.0-1?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/glance@2:13.0.0-1%3Fdistro=trixie
1
url pkg:deb/debian/glance@2:13.0.0-4
purl pkg:deb/debian/glance@2:13.0.0-4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-br4q-499g-vqhg
1
vulnerability VCID-h6rd-5p7q-s3gq
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/glance@2:13.0.0-4
2
url pkg:deb/debian/glance@2:21.0.0-2%2Bdeb11u1?distro=trixie
purl pkg:deb/debian/glance@2:21.0.0-2%2Bdeb11u1?distro=trixie
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-yzt4-fp6y-h3f1
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/glance@2:21.0.0-2%252Bdeb11u1%3Fdistro=trixie
3
url pkg:deb/debian/glance@2:25.1.0-2%2Bdeb12u1?distro=trixie
purl pkg:deb/debian/glance@2:25.1.0-2%2Bdeb12u1?distro=trixie
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-yzt4-fp6y-h3f1
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/glance@2:25.1.0-2%252Bdeb12u1%3Fdistro=trixie
4
url pkg:deb/debian/glance@2:30.0.0-3?distro=trixie
purl pkg:deb/debian/glance@2:30.0.0-3?distro=trixie
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-yzt4-fp6y-h3f1
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/glance@2:30.0.0-3%3Fdistro=trixie
5
url pkg:deb/debian/glance@2:32.0.0-1?distro=trixie
purl pkg:deb/debian/glance@2:32.0.0-1?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/glance@2:32.0.0-1%3Fdistro=trixie
6
url pkg:deb/debian/glance@2:32.0.0-2?distro=trixie
purl pkg:deb/debian/glance@2:32.0.0-2?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/glance@2:32.0.0-2%3Fdistro=trixie
Affected_packages
0
url pkg:deb/debian/glance@2012.1.1-5
purl pkg:deb/debian/glance@2012.1.1-5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-9sg5-tbvn-syba
1
vulnerability VCID-9zm2-a38f-33g3
2
vulnerability VCID-br4q-499g-vqhg
3
vulnerability VCID-fh42-vdj2-dqgu
4
vulnerability VCID-fwaa-nnw4-1qcz
5
vulnerability VCID-g1mf-hrds-bubz
6
vulnerability VCID-h6rd-5p7q-s3gq
7
vulnerability VCID-hbpu-kpak-2uer
8
vulnerability VCID-k2u9-5g8v-bucz
9
vulnerability VCID-ruvh-knrw-pygu
10
vulnerability VCID-t91r-2xja-17hy
11
vulnerability VCID-tafu-6gx3-n7bf
12
vulnerability VCID-uveb-gt8h-1kcr
13
vulnerability VCID-wvq2-r6u8-7bet
14
vulnerability VCID-zgpj-5an4-mucg
15
vulnerability VCID-zy9m-d25c-5uga
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/glance@2012.1.1-5
1
url pkg:deb/debian/glance@2014.1.3-12
purl pkg:deb/debian/glance@2014.1.3-12
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-9sg5-tbvn-syba
1
vulnerability VCID-br4q-499g-vqhg
2
vulnerability VCID-g1mf-hrds-bubz
3
vulnerability VCID-h6rd-5p7q-s3gq
4
vulnerability VCID-hbpu-kpak-2uer
5
vulnerability VCID-k2u9-5g8v-bucz
6
vulnerability VCID-ruvh-knrw-pygu
7
vulnerability VCID-tafu-6gx3-n7bf
8
vulnerability VCID-zy9m-d25c-5uga
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/glance@2014.1.3-12
2
url pkg:deb/debian/glance@2014.1.3-12%2Bdeb8u1
purl pkg:deb/debian/glance@2014.1.3-12%2Bdeb8u1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-9sg5-tbvn-syba
1
vulnerability VCID-br4q-499g-vqhg
2
vulnerability VCID-g1mf-hrds-bubz
3
vulnerability VCID-h6rd-5p7q-s3gq
4
vulnerability VCID-hbpu-kpak-2uer
5
vulnerability VCID-k2u9-5g8v-bucz
6
vulnerability VCID-ruvh-knrw-pygu
7
vulnerability VCID-tafu-6gx3-n7bf
8
vulnerability VCID-zy9m-d25c-5uga
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/glance@2014.1.3-12%252Bdeb8u1
3
url pkg:deb/debian/glance@2:12.0.0-3~bpo8%2B1
purl pkg:deb/debian/glance@2:12.0.0-3~bpo8%2B1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-br4q-499g-vqhg
1
vulnerability VCID-h6rd-5p7q-s3gq
2
vulnerability VCID-ruvh-knrw-pygu
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/glance@2:12.0.0-3~bpo8%252B1
References
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-7200.json
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-7200.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2017-7200
reference_id
reference_type
scores
0
value 0.00375
scoring_system epss
scoring_elements 0.59147
published_at 2026-04-12T12:55:00Z
1
value 0.00375
scoring_system epss
scoring_elements 0.59164
published_at 2026-04-11T12:55:00Z
2
value 0.00375
scoring_system epss
scoring_elements 0.59145
published_at 2026-04-09T12:55:00Z
3
value 0.00375
scoring_system epss
scoring_elements 0.59142
published_at 2026-04-08T12:55:00Z
4
value 0.00375
scoring_system epss
scoring_elements 0.59091
published_at 2026-04-07T12:55:00Z
5
value 0.00375
scoring_system epss
scoring_elements 0.59126
published_at 2026-04-04T12:55:00Z
6
value 0.00375
scoring_system epss
scoring_elements 0.59103
published_at 2026-04-02T12:55:00Z
7
value 0.00375
scoring_system epss
scoring_elements 0.59028
published_at 2026-04-01T12:55:00Z
8
value 0.00377
scoring_system epss
scoring_elements 0.59327
published_at 2026-04-18T12:55:00Z
9
value 0.00377
scoring_system epss
scoring_elements 0.59287
published_at 2026-04-13T12:55:00Z
10
value 0.00377
scoring_system epss
scoring_elements 0.59321
published_at 2026-04-16T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2017-7200
2
reference_url https://bugs.launchpad.net/ossn/+bug/1153614
reference_id
reference_type
scores
0
value 5.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://bugs.launchpad.net/ossn/+bug/1153614
3
reference_url https://bugs.launchpad.net/ossn/+bug/1606495
reference_id
reference_type
scores
0
value 5.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://bugs.launchpad.net/ossn/+bug/1606495
4
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7200
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7200
5
reference_url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
reference_id
reference_type
scores
0
value 3.5
scoring_system cvssv2
scoring_elements AV:N/AC:M/Au:S/C:P/I:N/A:N
url https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
6
reference_url https://github.com/openstack/glance
reference_id
reference_type
scores
0
value 5.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/openstack/glance
7
reference_url https://github.com/openstack/glance/commit/b1ac90f7914d91b25144cc4063fa994fb5019ee3
reference_id
reference_type
scores
0
value 5.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/openstack/glance/commit/b1ac90f7914d91b25144cc4063fa994fb5019ee3
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2017-7200
reference_id
reference_type
scores
0
value 5.0
scoring_system cvssv2
scoring_elements AV:N/AC:L/Au:N/C:P/I:N/A:N
1
value 5.8
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
2
value 5.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
3
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2017-7200
9
reference_url https://wiki.openstack.org/wiki/OSSN/OSSN-0078
reference_id
reference_type
scores
0
value 5.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://wiki.openstack.org/wiki/OSSN/OSSN-0078
10
reference_url http://www.securityfocus.com/bid/96988
reference_id
reference_type
scores
0
value 5.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url http://www.securityfocus.com/bid/96988
11
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=1434244
reference_id 1434244
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=1434244
12
reference_url https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:openstack:glance:*:*:*:*:*:*:*:*
reference_id cpe:2.3:a:openstack:glance:*:*:*:*:*:*:*:*
reference_type
scores
url https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:openstack:glance:*:*:*:*:*:*:*:*
13
reference_url https://github.com/advisories/GHSA-j6mr-cm6x-h6jg
reference_id GHSA-j6mr-cm6x-h6jg
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-j6mr-cm6x-h6jg
Weaknesses
0
cwe_id 918
name Server-Side Request Forgery (SSRF)
description The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
1
cwe_id 937
name OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.
2
cwe_id 1035
name OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.
Exploits
Severity_range_score3.5 - 6.9
Exploitability0.5
Weighted_severity6.2
Risk_score3.1
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-ruvh-knrw-pygu