Unrated severityNVD Advisory· Published May 14, 2014· Updated Jun 16, 2026

CVE-2013-4471

Description

The Identity v3 API in OpenStack Dashboard (Horizon) before 2013.2 does not require the current password when changing passwords for user accounts, which makes it easier for remote attackers to change a user password by leveraging the authentication token for that user.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

OpenStack/Horizon2 versions
cpe:2.3:a:openstack:horizon:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:openstack:horizon:*:*:*:*:*:*:*:*range: >=2013.1,<2013.2
- (no CPE)range: <2013.2

Patches

Vulnerability mechanics

References

bugs.launchpad.net/horizon/+bug/1237989nvdIssue TrackingPatchThird Party Advisory
lists.openstack.org/pipermail/openstack/2013-November/003299.htmlnvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000