VIR Vulnerability Intelligence Relay

CVE-2015-2687

medium
Published 2017-08-09 · Modified 2024-11-25
CVSS v3
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v2
1.9
VIR risk
4.7

Description

OpenStack Compute (nova) Icehouse, Juno and Havana when live migration fails allows local users to access VM volumes that they would normally not have permissions for.

Predictions

Exploit likelihood
47%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2015-2687

OS impact
OSVersionStatusFixed in
debian debianbookwormfixed2014.1-1
debian debianbullseyefixed2014.1-1
debian debianforkyfixed2014.1-1
debian debiansidfixed2014.1-1
debian debiantrixiefixed2014.1-1

Package impact
EcosystemPackageVulnerableFixed
python PyPInova<15.0.0.0b115.0.0.0b1

Application impact
VendorProductVersionsFixed
openstackcompute2013.2
openstackcompute2013.2.1
openstackcompute2013.2.2
openstackcompute2013.2.3
openstackcompute2013.2.4
openstackcompute2014.1
openstackcompute2014.1.1
openstackcompute2014.1.2
openstackcompute2014.1.3
openstackcompute2014.1.4
openstackcompute2014.1.5
openstackcompute2014.2
openstackcompute2014.2.1
openstackcompute2014.2.2
openstackcompute2014.2.3
openstackcompute2014.2.4

References

CWEs

CWE-284

Verify integrity in audit chain (admin only). AS-IS.