{"id":"CVE-2015-7713","aliases":["GHSA-67rh-9p29-vrxr","PYSEC-2026-867"],"title":"OpenStack Compute (Nova) allows remote attackers to bypass intended restriction","summary":"OpenStack Compute (Nova) allows remote attackers to bypass intended restriction","severity":"medium","vendor":"nova","product":"nova","ecosystem":"pip","affected":["nova < 2014.2.4","nova >= 2015.1.0, < 2015.1.2"],"patched":["nova 2014.2.4","nova 2015.1.2"],"published":"2022-05-14","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:49:38.015317484Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-67rh-9p29-vrxr","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7713"},{"url":"https://access.redhat.com/errata/RHSA-2015:2673"},{"url":"https://access.redhat.com/errata/RHSA-2015:2684"},{"url":"https://access.redhat.com/errata/RHSA-2016:0013"},{"url":"https://access.redhat.com/errata/RHSA-2016:0017"},{"url":"https://access.redhat.com/security/cve/CVE-2015-7713"},{"url":"https://bugs.launchpad.net/nova/+bug/1491307"},{"url":"https://bugs.launchpad.net/nova/+bug/1492961"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1269119"},{"url":"https://opendev.org/openstack/nova"},{"url":"https://security.openstack.org/ossa/OSSA-2015-021.html"},{"url":"https://web.archive.org/web/20200228024902/http://www.securityfocus.com/bid/76960"},{"url":"http://rhn.redhat.com/errata/RHSA-2015-2684.html"},{"url":"http://www.securityfocus.com/bid/76960"}],"tags":["osv","pip"],"epss":0.037,"epssPercentile":0.89263,"ingestedAt":"2026-07-08T18:25:46.309Z","slug":"CVE-2015-7713","body":"## Overview\n\nOpenStack Compute (Nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) do not properly apply security group changes, which allows remote attackers to bypass intended restriction by leveraging an instance that was running when the change was made.\n\n## Affected packages\n\n- `nova < 2014.2.4`\n- `nova >= 2015.1.0, < 2015.1.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `nova 2014.2.4`\n- `nova 2015.1.2`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.7,"exploitation":0,"ransomware":0},"changes":[]}