Advisory details:
gitlab / pypi/horizon/CVE-2013-4471
| Advisory ID | gitlab/pypi/horizon/CVE-2013-4471 |
| Aliases |
CVE-2013-4471
|
| Summary | Credentials Management The Identity v3 API in OpenStack Dashboard (Horizon) does not require the current password when changing passwords for user accounts, which makes it easier for remote attackers to change a user password by leveraging the authentication token for that user. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 0.0 |
| Risk | |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| There are no known CWE. |
| System | Score | Found at |
|---|---|---|
| cvssv2 | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/horizon/CVE-2013-4471.yml |
| Reference id | Reference type | URL |
|---|---|---|
| https://bugs.launchpad.net/horizon/+bug/1237989 | ||
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4471 |
No exploits are available.
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Exploitability (E) | Access Vector (AV) | Access Complexity (AC) | Authentication (Au) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|
high functional unproven proof_of_concept not_defined |
local adjacent_network network |
high medium low |
multiple single none |
none partial complete |
none partial complete |
none partial complete |
There are no SSVC decisions available.