Vulnerability Details : CVE-2024-32498
An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Cinder and Nova deployments are affected; only Glance deployments with image conversion enabled are affected.
Vulnerability category: Bypass
Products affected by CVE-2024-32498
- cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:*
- cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:*
- cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:*
- cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:*
- cpe:2.3:a:openstack:glance:*:*:*:*:*:*:*:*
- cpe:2.3:a:openstack:glance:*:*:*:*:*:*:*:*
- cpe:2.3:a:openstack:glance:*:*:*:*:*:*:*:*
- cpe:2.3:a:openstack:glance:27.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:openstack:cinder:*:*:*:*:*:*:*:*
- cpe:2.3:a:openstack:cinder:*:*:*:*:*:*:*:*
- cpe:2.3:a:openstack:cinder:*:*:*:*:*:*:*:*
- cpe:2.3:a:openstack:cinder:24.0.0:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2024-32498
0.10%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 30 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2024-32498
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.5
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
2.8
|
3.6
|
134c704f-9b21-4f2e-91b3-4a467353bcc0 | 2024-10-30 |
|
6.5
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
2.8
|
3.6
|
NIST | 2024-07-08 |
|
8.8
|
HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
N/A
|
N/A
|
RedHat-CVE-2024-32498 | 2024-07-02 |
CWE ids for CVE-2024-32498
-
The product makes files or directories accessible to unauthorized actors, even though they should not be.Assigned by: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
References for CVE-2024-32498
-
http://www.openwall.com/lists/oss-security/2024/07/02/2
oss-security - [OSSA-2024-001] OpenStack Cinder, Glance, Nova: Arbitrary file access through custom QCOW2 external data (CVE-2024-32498)
-
https://launchpad.net/bugs/2059809
Issue Tracking;Patch
-
https://security.openstack.org/ossa/OSSA-2024-001.html
OSSA-2024-001: Arbitrary file access through custom QCOW2 external data — OpenStack Security Advisories 0.0.1.dev280 documentation
-
https://www.openwall.com/lists/oss-security/2024/07/02/2
oss-security - [OSSA-2024-001] OpenStack Cinder, Glance, Nova: Arbitrary file access through custom QCOW2 external data (CVE-2024-32498)Mailing List;Patch
Jump to