{"containers":{"cna":{"title":"Openstack glance: swift: s3: openstack glance: information disclosure of backend credentials via cached image request","metrics":[{"other":{"content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS"}],"descriptions":[{"lang":"en","value":"A flaw was found in OpenStack Glance. Remote authenticated users can exploit this vulnerability by requesting a cached image when the single-tenant Swift or S3 store is in use. This action causes the system to report the location field, which can lead to the disclosure of the operator's backend credentials."}],"affected":[{"vendor":"Red Hat","product":"OpenStack Folsom for RHEL 6","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openstack-glance","defaultStatus":"affected","versions":[{"version":"0:2012.2.3-8.el6ost","lessThan":"*","versionType":"rpm","status":"unaffected"}],"cpes":["cpe:/a:redhat:openstack:2::el6"]},{"vendor":"Red Hat","product":"Red Hat OpenStack Platform 16.2","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openstack-glance","defaultStatus":"unaffected","cpes":["cpe:/a:redhat:openstack:16.2"]},{"vendor":"Red Hat","product":"Red Hat OpenStack Platform 17.1","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openstack-glance","defaultStatus":"unaffected","cpes":["cpe:/a:redhat:openstack:17.1"]},{"vendor":"Red Hat","product":"Red Hat OpenStack Platform 18.0","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"openstack-glance","defaultStatus":"unaffected","cpes":["cpe:/a:redhat:openstack:18.0"]}],"references":[{"url":"http://osvdb.org/91304"},{"url":"http://rhn.redhat.com/errata/RHSA-2013-0707.html"},{"url":"http://secunia.com/advisories/52565"},{"url":"http://www.openwall.com/lists/oss-security/2013/03/14/15"},{"url":"http://www.securityfocus.com/bid/58490"},{"url":"http://www.ubuntu.com/usn/USN-1764-1"},{"url":"https://access.redhat.com/errata/RHSA-2013:0707","name":"RHSA-2013:0707","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-1840","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugs.launchpad.net/glance/+bug/1135541"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/82878"},{"url":"https://review.openstack.org/#/c/24437/"},{"url":"https://review.openstack.org/#/c/24438/"},{"url":"https://review.openstack.org/#/c/24439/"}],"datePublic":"2013-03-22T21:00:00.000Z","problemTypes":[{"descriptions":[{"cweId":"CWE-201","description":"Insertion of Sensitive Information Into Sent Data","lang":"en","type":"CWE"}]}],"x_redhatCweChain":"CWE-201: Insertion of Sensitive Information Into Sent Data","workarounds":[{"lang":"en","value":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}],"timeline":[{"lang":"en","time":"2026-04-02T15:06:11.210Z","value":"Reported to Red Hat."},{"lang":"en","time":"2013-03-22T21:00:00.000Z","value":"Made public."}],"providerMetadata":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-30T18:03:59.725Z"},"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-06T15:13:33.277Z"},"title":"CVE Program Container","references":[{"name":"openstack-glance-api-info-disclosure(82878)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/82878"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://review.openstack.org/#/c/24437/"},{"name":"USN-1764-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"],"url":"http://www.ubuntu.com/usn/USN-1764-1"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://review.openstack.org/#/c/24438/"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://bugs.launchpad.net/glance/+bug/1135541"},{"name":"52565","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/52565"},{"name":"RHSA-2013:0707","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://rhn.redhat.com/errata/RHSA-2013-0707.html"},{"name":"91304","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/91304"},{"name":"[oss-security] 20130314 [OSSA 2013-007] Backend credentials leak in Glance v1 API (CVE-2013-1840)","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://www.openwall.com/lists/oss-security/2013/03/14/15"},{"name":"58490","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/58490"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://review.openstack.org/#/c/24439/"}]}]},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2013-1840","datePublished":"2013-03-22T21:00:00.000Z","dateReserved":"2013-02-19T00:00:00.000Z","dateUpdated":"2026-10-30T18:03:59.725Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"}