{"id":"CVE-2013-4471","url":"https://www.cyber-defence.io/tools/cve/CVE-2013-4471","generatedAt":"2026-10-27T20:52:38.145Z","title":"The Identity v3 API in OpenStack Dashboard (Horizon) before 2013.2 does not require the current password when changing passwords for user accounts, which makes it easier for remote attackers to change a user password by leveraging the authentication…","description":"The Identity v3 API in OpenStack Dashboard (Horizon) before 2013.2 does not require the current password when changing passwords for user accounts, which makes it easier for remote attackers to change a user password by leveraging the authentication token for that user.","published":"2014-05-14T19:55:10.000Z","lastModified":"2026-06-16T23:57:17.000Z","status":"Modified","sourceIdentifier":"secalert@redhat.com","cvss":{"version":"2.0","score":5.5,"severity":"MEDIUM","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:N"},"cwe":["CWE-287"],"affected":["openstack/horizon"],"epss":{"score":0.01204,"percentile":0.6805,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (1.20%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"http://lists.openstack.org/pipermail/openstack/2013-November/003299.html","tags":["Vendor Advisory"],"source":"secalert@redhat.com"},{"url":"https://bugs.launchpad.net/horizon/+bug/1237989","tags":["Issue Tracking","Patch","Third Party Advisory"],"source":"secalert@redhat.com"},{"url":"http://lists.openstack.org/pipermail/openstack/2013-November/003299.html","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugs.launchpad.net/horizon/+bug/1237989","tags":["Issue Tracking","Patch","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2013-4471","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}