Unrated severityNVD Advisory· Published May 14, 2014· Updated May 6, 2026
CVE-2013-4471
CVE-2013-4471
Description
The Identity v3 API in OpenStack Dashboard (Horizon) before 2013.2 does not require the current password when changing passwords for user accounts, which makes it easier for remote attackers to change a user password by leveraging the authentication token for that user.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2- bugs.launchpad.net/horizon/+bug/1237989nvdIssue TrackingPatchThird Party Advisory
- lists.openstack.org/pipermail/openstack/2013-November/003299.htmlnvdVendor Advisory
News mentions
0No linked articles in our index yet.