How severe is CVE-2015-0259?

CVE-2015-0259 has a CVSS 2.0 base score of 5.1, rated medium severity.

Is CVE-2015-0259 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (61st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2015-0259?

CVE-2015-0259 primarily affects Openstack Nova. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2015-0259?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2015-0259 published?

CVE-2015-0259 was published on 2015-04-01 and last updated on 2026-06-17.

CVE-2015-0259

CVE-2015-0259 is a medium-severity vulnerability in Openstack Nova with a CVSS 2.0 base score of 5.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-345.

Key facts

Severity: Medium (CVSS 2.0 base score 5.1)
EPSS exploit prediction: 1% (61st percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-345
Affected product: Openstack Nova
Published: 2015-04-01
Last modified: 2026-06-17

Description

OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the authentication of users for access to consoles via a crafted webpage.

Frequently asked questions

What is CVE-2015-0259?: OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the authentication of users for access to consoles via a crafted webpage.
How severe is CVE-2015-0259?: CVE-2015-0259 has a CVSS 2.0 base score of 5.1, rated medium severity.
Is CVE-2015-0259 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (61st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2015-0259?: CVE-2015-0259 primarily affects Openstack Nova. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2015-0259?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2015-0259 published?: CVE-2015-0259 was published on 2015-04-01 and last updated on 2026-06-17.

References

Affected products (3)

cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:*
cpe:2.3:a:openstack:nova:2015.1.0:milestone1:*:*:*:*:*:*
cpe:2.3:a:openstack:nova:2015.1.0:milestone2:*:*:*:*:*:*

More vulnerabilities in Openstack Nova

CVE-2017-7214 — Critical (CVSS 9.8): An issue was discovered in exception_wrapper.py in OpenStack Nova 13.x through 13.1.3, 14.x through 14.0.4, and 15.x…
CVE-2011-3147 — High (CVSS 8.6): Versions of nova before 2012.1 could expose hypervisor host files to a guest operating system when processing a…
CVE-2017-17051 — High (CVSS 8.6): An issue was discovered in the default FilterScheduler in OpenStack Nova 16.0.3. By repeatedly rebuilding an instance…
CVE-2020-17376 — High (CVSS 8.3): An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1,…
CVE-2017-18191 — High (CVSS 7.5): An issue was discovered in OpenStack Nova 15.x through 15.1.0 and 16.x through 16.1.1. By detaching and reattaching an…
CVE-2015-5162 — High (CVSS 7.5): The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before…

All CVEs affecting Openstack Nova →

Other CWE-345 (Insufficient Verification of Data Authenticity) vulnerabilities

CVE-2026-35051 — Critical (CVSS 10.0): Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is an…
CVE-2014-8165 — Critical (CVSS 10.0): scripts/amsvis/powerpcAMS/amsnet.py in powerpc-utils-python uses the pickle Python module unsafely, which allows remote…
CVE-2026-50195 — Critical (CVSS 9.9): containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a vulnerability in the…
CVE-2022-36130 — Critical (CVSS 9.9): HashiCorp Boundary up to 0.10.1 did not properly perform data integrity checks to ensure the resources were associated…
CVE-2026-50214 — Critical (CVSS 9.8): The /v1/Plan service relies entirely on a shared global API token for full administrative management, allowing…
CVE-2025-15385 — Critical (CVSS 9.8): Insufficient Verification of Data Authenticity vulnerability in TECNO Mobile com.Afmobi.Boomplayer allows…

Browse all CWE-345 (Insufficient Verification of Data Authenticity) vulnerabilities →