CVE-2015-0259
openstack nova: no CVSS score yet. EPSS 1.1% chance of exploitation in the next 30 days. Fixed in nova 2014.1.4, 2014.2.3.
OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the authentication of users for access to consoles via a crafted webpage.
- EPSS
- 1.1% chance of exploitation in the next 30 days; higher than 64% of CVEs (scores of 2026-10-31)
- CWE
- CWE-345
- Published
- Modified
- Record from
- the NVD, synced
Affected
- openstack:nova
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-x8xr-rm9r-7mvf | PyPI | nova | <2014.1.4 | 2014.1.4 |
| GHSA-x8xr-rm9r-7mvf | PyPI | nova | >=2014.2.0 <2014.2.3 | 2014.2.3 |
| PYSEC-2026-883 | PyPI | nova | <2014.1.4 >=2014.2.0 <2014.2.3 | 2014.1.4, 2014.2.3 |