{"id":"CVE-2013-0266","title":"Puppetlabs-cinder: packstack: openstack: puppetlabs-cinder: information disclosure of openstack administrative passwords due to world-readable configuration files.","summary":"A flaw was found in the `puppetlabs-cinder` module, as used in PackStack. This vulnerability is due to incorrect file permissions, specifically world-readable permissions, on the `cinder.conf` and `api-paste.ini` configuration files. A l…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvssSource":"cna","cwe":["CWE-276"],"vendor":"Red Hat","product":"openstack-packstack","affected":["openstack-packstack (all versions)","openstack-packstack (all versions)","openstack-packstack (all versions)"],"published":"2013-03-08","updated":"2026-10-30","sourceUpdated":"2026-10-30T18:03:42.518Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2013-0266","references":[{"url":"http://rhn.redhat.com/errata/RHSA-2013-0595.html"},{"url":"https://access.redhat.com/errata/RHSA-2013:0595","label":"RHSA-2013:0595"},{"url":"https://access.redhat.com/security/cve/CVE-2013-0266"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=908581"},{"url":"https://github.com/puppetlabs/puppetlabs-cinder/commit/7da792fbd40c0e6eae1ee093aa00e0b177bd2ebc"}],"tags":["cve.org"],"epss":0.00269,"epssPercentile":0.19243,"ingestedAt":"2026-11-05T16:24:31.291Z","slug":"CVE-2013-0266","body":"## Overview\n\nA flaw was found in the `puppetlabs-cinder` module, as used in PackStack. This vulnerability is due to incorrect file permissions, specifically world-readable permissions, on the `cinder.conf` and `api-paste.ini` configuration files. A local user can exploit this by reading these files, which leads to the disclosure of OpenStack administrative passwords. This information disclosure could allow unauthorized access to sensitive OpenStack resources.\n\n## Affected\n\n- `openstack-packstack (all versions)`\n- `openstack-packstack (all versions)`\n- `openstack-packstack (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}