CWE Code: 20
Vulnerability Type: privilege_escalation
CVSS Score: 4.0
CWE Name:  Improper Input Validation
Summary: when using the linux bridge ml2 driver, non-privileged tenants are able to create and attach ports without specifying an ip address, bypassing ip address validation. a potential denial of service could occur if an ip address, conflicting with existing guests or routers, is then assigned from outside of the allowed allocation pool. versions of openstack-neutron before 13.0.0.0b2, 12.0.3 and 11.0.5 are vulnerable.
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): NONE/NONE/PARTIAL
Published Date: 2018-09-10
Last Modified Date: 2019-10-09