CVE-2014-0056: OpenStack Neutron Improper Authentication… – CVSS 2.1 · Watchpost

← All vulnerabilities

OpenStack Neutron Improper Authentication vulnerability

LOW 2.1CVE-2014-0056 · GHSA-72p9-6gc7-q93r · PYSEC-2026-851 · Published 08/05/2014 · updated 17/06/2026

In short

CVE-2014-0056 is a LOW (CVSS 2.1) vulnerability affecting neutron, neutron (openstack).
Chance of exploitation in the next 30 days (EPSS): 1.4%, higher than 73.3% of all vulnerabilities.
Fix: update to 2013.2.3 or later.

Package	Affected versions	Patched versions
neutron PyPI	`≥ 2012.2, < 2013.2.3`	`2013.2.3`
neutron openstack	`= 2012.2= 2012.2.1= 2012.2.2= 2012.2.3= 2012.2.4= 2013.1= 2013.1.1= 2013.1.2= 2013.1.3= 2013.1.4= 2013.1.5= 2013.2= 2013.2.1= 2013.2.2`	No fix yet

Description

The l3-agent in OpenStack Neutron 2012.2 before 2013.2.3 does not check the tenant id when creating ports, which allows remote authenticated users to plug ports into the routers of arbitrary tenants via the device id in a port-create command.

NVD description

The l3-agent in OpenStack Neutron 2012.2 before 2013.2.3 does not check the tenant id when creating ports, which allows remote authenticated users to plug ports into the routers of arbitrary tenants via the device id in a port-create command.

References

nvd.nist.gov/vuln/detail/CVE-2014-0056 · ADVISORY
access.redhat.com/errata/RHSA-2014:0516 · WEB
access.redhat.com/security/cve/CVE-2014-0056 · WEB
bugs.launchpad.net/neutron/+bug/1243327 · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
opendev.org/openstack/neutron · PACKAGE
rhn.redhat.com/errata/RHSA-2014-0516.html · WEB
openwall.com/lists/oss-security/2014/03/27/5 · WEB
ubuntu.com/usn/USN-2194-1 · WEB
pypi.org/project/neutron · PACKAGE
GitHub Advisory GHSA-72p9-6gc7-q93r · ADVISORY

More vulnerabilities in neutron

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free