CVE-2014-0071 : PackStack in Red Hat OpenStack 4.0 does not enforce the default security groups

PackStack in Red Hat OpenStack 4.0 does not enforce the default security groups when deployed to Neutron, which allows remote attackers to bypass intended access restrictions and make unauthorized connections.

Published 2014-04-17 14:55:06

Updated 2025-04-12 10:46:41

Source Red Hat, Inc.

View at NVD, CVE.org

Products affected by CVE-2014-0071

Redhat » Openstack » Version: 4.0
cpe:2.3:a:redhat:openstack:4.0:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2014-0071

EPSS FAQ

0.20%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 39 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2014-0071

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
6.4	MEDIUM	AV:N/AC:L/Au:N/C:P/I:P/A:N	10.0	4.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: None

CWE ids for CVE-2014-0071

CWE-264

Assigned by: nvd@nist.gov (Primary)

References for CVE-2014-0071

https://bugzilla.redhat.com/show_bug.cgi?id=1064163

1064163 – (CVE-2014-0071) CVE-2014-0071 OpenStack PackStack: Neutron Security Groups fail to block network traffic
http://www.securityfocus.com/bid/66001

OpenStack PackStack CVE-2014-0071 Security Bypass Vulnerability
http://rhn.redhat.com/errata/RHSA-2014-0233.html

RHSA-2014:0233 - Security Advisory - Red Hat Customer Portal
Vendor Advisory

Jump to

Vulnerability Details : CVE-2014-0071

Products affected by CVE-2014-0071

Exploit prediction scoring system (EPSS) score for CVE-2014-0071

CVSS scores for CVE-2014-0071

CWE ids for CVE-2014-0071

References for CVE-2014-0071