A flaw was found in the `puppetlabs-cinder` module, as used in PackStack. This vulnerability is due to incorrect file permissions, specifically world-readable permissions, on the `cinder.conf` and `api-paste.ini` configuration files. A local user can exploit this by reading these files, which leads to the disclosure of OpenStack administrative passwords. This information disclosure could allow unauthorized access to sensitive OpenStack resources.
CVE-2013-0266
CVSS base score
5.5 (v3.1)
Severity
MEDIUM
Attack vector
Local
Weakness
CWE-276, CWE-362
Last modified
October 30, 2026
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
openstack essex
openstack folsom
References
- rhn.redhat.com Vendor Advisory
- access.redhat.com
- access.redhat.com
- bugzilla.redhat.com
- github.com
- rhn.redhat.com Vendor Advisory
- bugzilla.redhat.com
- github.com