Vulnerability Details : CVE-2017-7200
An SSRF issue was discovered in OpenStack Glance before Newton. The 'copy_from' feature in the Image Service API v1 allowed an attacker to perform masked network port scans. With v1, it is possible to create images with a URL such as 'http://localhost:22'. This could then allow an attacker to enumerate internal network details while appearing masked, since the scan would appear to originate from the Glance Image service.
Vulnerability category: Server-side request forgery (SSRF)
Products affected by CVE-2017-7200
- cpe:2.3:a:openstack:glance:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2017-7200
0.20%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 57 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-7200
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:N/A:N |
10.0
|
2.9
|
NIST | |
|
5.8
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N |
3.9
|
1.4
|
NIST |
CWE ids for CVE-2017-7200
-
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-7200
-
https://wiki.openstack.org/wiki/OSSN/OSSN-0078
OSSN/OSSN-0078 - OpenStackVendor Advisory
-
http://www.securityfocus.com/bid/96988
OpenStack Glance CVE-2017-7200 Security Bypass VulnerabilityThird Party Advisory;VDB Entry
-
https://bugs.launchpad.net/ossn/+bug/1606495
Bug #1606495 “copy_from in api v1 allows network port scan” : Bugs : OpenStack Security NotesThird Party Advisory
-
https://bugs.launchpad.net/ossn/+bug/1153614
Bug #1153614 “Add a policy to control copy-from functionality” : Bugs : GlanceThird Party Advisory
Jump to