CVE-2024-40767Medium· 6.5▾ SunlitOpenStack Nova vulnerable to unauthorized access to potentially sensitive data
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.9%
In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 image with a backing file path or VMDK flat image with a descriptor file path, an authenticated user may convince systems to return a copy of the referenced file's contents from the server, resulting in unauthorized access to potentially sensitive data. All Nova deployments are affected. NOTE: this issue exists because of an incomplete fix for CVE-2022-47951 and CVE-2024-32498.
nova <= 27.4.0nova >= 28.0.0, <= 28.2.0nova >= 29.0.0, <= 29.1.0Refer to the advisory for the patched release.
Connected by shared product, vendor, weakness, or advisory.
CVE-2017-16239Medium· 6.5OpenStack Nova Filter Scheduler Bypass
CVE-2017-17051High· 8.6OpenStack Nova DoS by rebuilding the same instance with a new image multiple times
CVE-2022-37394Low· 3.3OpenStack Nova Changing vnic_type breaks compute service restart
CVE-2011-4596MediumOpenStack Nova Multiple directory traversal vulnerabilities
CVE-2012-1585MediumOpenStack Nova Long server names grow nova-api log files significantly
CVE-2013-4185MediumOpenStack Nova Denial of Service in network source security groups