How severe is CVE-2014-2573?

CVE-2014-2573 has a CVSS 2.0 base score of 2.3, rated low severity.

Is CVE-2014-2573 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (49th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2014-2573?

CVE-2014-2573 primarily affects Openstack Compute. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2014-2573?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2014-2573 published?

CVE-2014-2573 was published on 2014-03-25 and last updated on 2026-06-17.

CVE-2014-2573

CVE-2014-2573 is a low-severity vulnerability in Openstack Compute with a CVSS 2.0 base score of 2.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-264.

Key facts

Severity: Low (CVSS 2.0 base score 2.3)
EPSS exploit prediction: 1% (49th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-264
Affected product: Openstack Compute
Published: 2014-03-25
Last modified: 2026-06-17

Description

The VMWare driver in OpenStack Compute (Nova) 2013.2 through 2013.2.2 does not properly put VMs into RESCUE status, which allows remote authenticated users to bypass the quota limit and cause a denial of service (resource consumption) by requesting the VM be put into rescue and then deleting the image.

Frequently asked questions

What is CVE-2014-2573?: The VMWare driver in OpenStack Compute (Nova) 2013.2 through 2013.2.2 does not properly put VMs into RESCUE status, which allows remote authenticated users to bypass the quota limit and cause a denial of service (resource consumption) by requesting the VM be put into rescue and then deleting the image.
How severe is CVE-2014-2573?: CVE-2014-2573 has a CVSS 2.0 base score of 2.3, rated low severity.
Is CVE-2014-2573 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (49th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2014-2573?: CVE-2014-2573 primarily affects Openstack Compute. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2014-2573?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2014-2573 published?: CVE-2014-2573 was published on 2014-03-25 and last updated on 2026-06-17.

References

Affected products (3)

cpe:2.3:a:openstack:compute:2013.2:*:*:*:*:*:*:*
cpe:2.3:a:openstack:compute:2013.2.1:*:*:*:*:*:*:*
cpe:2.3:a:openstack:compute:2013.2.2:*:*:*:*:*:*:*

More vulnerabilities in Openstack Compute

CVE-2013-7130 — High (CVSS 7.1): The i_create_images_and_backing (aka create_images_and_backing) method in libvirt driver in OpenStack Compute (Nova)…
CVE-2014-0167 — Medium (CVSS 6.0): The Nova EC2 API security group implementation in OpenStack Compute (Nova) 2013.1 before 2013.2.4 and icehouse before…
CVE-2013-2255 — Medium (CVSS 5.9): HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to…
CVE-2015-2687 — Medium (CVSS 4.7): OpenStack Compute (nova) Icehouse, Juno and Havana when live migration fails allows local users to access VM volumes…
CVE-2013-4179 — Medium (CVSS 4.3): The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows…
CVE-2012-2654 — Medium (CVSS 4.3): The (1) EC2 and (2) OS APIs in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) do not…

All CVEs affecting Openstack Compute →

Other CWE-264 (Permissions, Privileges, and Access Controls) vulnerabilities

CVE-2016-8363 — Critical (CVSS 10.0): An issue was discovered in Moxa OnCell OnCellG3470A-LTE, AWK-1131A/3131A/4131A Series, AWK-3191 Series, AWK-5232/6232…
CVE-2016-7457 — Critical (CVSS 10.0): VMware vRealize Operations (aka vROps) 6.x before 6.4.0 allows remote authenticated users to gain privileges, or halt…
CVE-2015-7425 — Critical (CVSS 10.0): The Data Protection component in the VMware vSphere GUI in IBM Tivoli Storage Manager for Virtual Environments: Data…
CVE-2015-8267 — Critical (CVSS 10.0): The PasswordReset.Controllers.ResetController.ChangePasswordIndex method in PasswordReset.dll in Dovestones AD Self…
CVE-2015-7919 — Critical (CVSS 10.0): SearchBlox 8.3 before 8.3.1 allows remote attackers to write to the config file, and consequently cause a denial of…
CVE-2015-7071 — Critical (CVSS 10.0): The File Bookmark component in Apple OS X before 10.11.2 allows attackers to bypass a sandbox protection mechanism for…

Browse all CWE-264 (Permissions, Privileges, and Access Controls) vulnerabilities →