{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2013-11-22T00:00:00", "descriptions": [{"lang": "en", "value": "The Identity v3 API in OpenStack Dashboard (Horizon) before 2013.2 does not require the current password when changing passwords for user accounts, which makes it easier for remote attackers to change a user password by leveraging the authentication token for that user."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2014-05-14T18:57:01", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"name": "[Openstack] 20131122 [OSSG][OSSN] Authenticated users are able to update passwords without providing their current password", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://lists.openstack.org/pipermail/openstack/2013-November/003299.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugs.launchpad.net/horizon/+bug/1237989"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T16:45:14.609Z"}, "title": "CVE Program Container", "references": [{"name": "[Openstack] 20131122 [OSSG][OSSN] Authenticated users are able to update passwords without providing their current password", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://lists.openstack.org/pipermail/openstack/2013-November/003299.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugs.launchpad.net/horizon/+bug/1237989"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2013-4471", "datePublished": "2014-05-14T19:00:00", "dateReserved": "2013-06-12T00:00:00", "dateUpdated": "2024-08-06T16:45:14.609Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openstack:horizon:*:*:*:*:*:*:*:*", "matchCriteriaId": "CB7E5E20-1AE0-41D8-BFF5-F04EED9E6470", "versionEndExcluding": "2013.2", "versionStartIncluding": "2013.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Identity v3 API in OpenStack Dashboard (Horizon) before 2013.2 does not require the current password when changing passwords for user accounts, which makes it easier for remote attackers to change a user password by leveraging the authentication token for that user."}, {"lang": "es", "value": "La API Identity v3 en OpenStack Dashboard (Horizon) anterior a 2013.2 no requiere la contrase\u00f1a actual cuando cambia contrase\u00f1as para cuentas de usuarios, lo que facilita a atacantes remotos cambiar una contrase\u00f1a de usuario mediante el aprovechamiento del token de autenticaci\u00f3n para este usuario."}], "id": "CVE-2013-4471", "lastModified": "2021-03-09T14:43:16.633", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 5.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2014-05-14T19:55:10.277", "references": [{"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "http://lists.openstack.org/pipermail/openstack/2013-November/003299.html"}, {"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://bugs.launchpad.net/horizon/+bug/1237989"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "OpenStack: python-django-horizonpassword reset vulnerability", "id": "1023586", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1023586"}, "csaw": false, "cvss": {"cvss_base_score": "2.6", "cvss_scoring_vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N", "status": "draft"}, "details": ["The Identity v3 API in OpenStack Dashboard (Horizon) before 2013.2 does not require the current password when changing passwords for user accounts, which makes it easier for remote attackers to change a user password by leveraging the authentication token for that user."], "name": "CVE-2013-4471", "package_state": [{"cpe": "cpe:/a:redhat:openstack:3", "fix_state": "Affected", "package_name": "python-django-horizon", "product_name": "Red Hat OpenStack Platform 3"}, {"cpe": "cpe:/a:redhat:openstack:4", "fix_state": "Affected", "package_name": "python-django-horizon", "product_name": "Red Hat OpenStack Platform 4"}], "public_date": "2013-10-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2013-4471\nhttps://nvd.nist.gov/vuln/detail/CVE-2013-4471"], "threat_severity": "Moderate"}