← Vulnerability feed

Vulnerability record · CVE-2012-2654 · published 21 June 2012

CVE-2012-2654: Openstack compute improper input validation vulnerability

Openstack · Compute

The (1) EC2 and (2) OS APIs in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) do not properly check the protocol when security groups are created and the network protocol is not specified entirely in lowercase, which allows remote attackers to bypass intended access restrictions.

4.3 CVSS 2.0 Medium EPSS 2.6% · top 15.1% CWE-20 · Improper input validation
4.3CVSS 2.0 base score
2.6%EPSS exploitation probability, 30 days
NoNot in CISA KEV
3Affected product versions listed by NVD
18References, 4 tagged exploit
16 Jun 2026Last modified by NVD

Description

The (1) EC2 and (2) OS APIs in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) do not properly check the protocol when security groups are created and the network protocol is not specified entirely in lowercase, which allows remote attackers to bypass intended access restrictions.

AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected products

3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://secunia.com/advisories/46808 Vendor Advisory
http://secunia.com/advisories/49439 Vendor Advisory
http://www.ubuntu.com/usn/USN-1466-1
https://bugs.launchpad.net/nova/+bug/985184 Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/76110
https://github.com/openstack/nova/commit/9f9e9da777161426a6f8cb4314b78e09beac2978 ExploitPatch
https://github.com/openstack/nova/commit/ff06c7c885dc94ed7c828e8cdbb8b5d850a7e654 ExploitPatch
https://lists.launchpad.net/openstack/msg12883.html
https://review.openstack.org/#/c/8239/
http://secunia.com/advisories/46808 Vendor Advisory
http://secunia.com/advisories/49439 Vendor Advisory
http://www.ubuntu.com/usn/USN-1466-1
https://bugs.launchpad.net/nova/+bug/985184 Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/76110
https://github.com/openstack/nova/commit/9f9e9da777161426a6f8cb4314b78e09beac2978 ExploitPatch
https://github.com/openstack/nova/commit/ff06c7c885dc94ed7c828e8cdbb8b5d850a7e654 ExploitPatch
https://lists.launchpad.net/openstack/msg12883.html
https://review.openstack.org/#/c/8239/

Track CVE-2012-2654 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2013-0261Openstack essex link following vulnerabilityA flaw was found in PackStack. A local user could exploit a symlink attack on a temporary file with a predictable name in the `/tmp` directory. This …EPSS 0.34%7.6CVE-2013-0335Openstack essex insufficient session expiration vulnerabilityOpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to gain access to a VM in opportunistic circu…EPSS 2.1%7.1CVE-2013-7130Openstack compute information exposure vulnerabilityThe i_create_images_and_backing (aka create_images_and_backing) method in libvirt driver in OpenStack Compute (Nova) Grizzly, Havana, and Icehouse, w…EPSS 2.4%6.5CVE-2013-0208Openstack essex permissions and access controls vulnerabilityThe boot-from-volume feature in OpenStack Compute (Nova) Folsom and Essex, when using nova-volumes, allows remote authenticated users to boot from ot…EPSS 2.5%6.0CVE-2014-0167Openstack compute permissions and access controls vulnerabilityThe Nova EC2 API security group implementation in OpenStack Compute (Nova) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 does not enforce R…EPSS 1.6%5.9CVE-2013-2255Openstack compute improper certificate validation vulnerabilityHTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL cert…EPSS 0.97%5.5CVE-2013-0266Openstack essex incorrect default permissions vulnerabilityA flaw was found in the `puppetlabs-cinder` module, as used in PackStack. This vulnerability is due to incorrect file permissions, specifically world…EPSS 0.27%5.5CVE-2012-5482Openstack essex permissions and access controls vulnerabilityThe v2 API in OpenStack Glance Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to delete arbitrary non-protected image…EPSS 2.7%

Source: NIST National Vulnerability Database (record CVE-2012-2654), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.