{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"v1"}],"component":"glance","cve_ids":["CVE-2013-1840"],"ecosystem":"PyPI","epss":0.01367,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-c8w9-83vg-r8vv","id":"tcs_01M5KG5XCQ1MHT38VRXJ5V4R8E","modified_at":"2026-06-10T17:01:19.387374557Z","published_at":"2013-03-22T21:55:01.487Z","references":["https://osv.dev/vulnerability/PYSEC-2013-46","http://osvdb.org/91304","http://www.openwall.com/lists/oss-security/2013/03/14/15","http://www.securityfocus.com/bid/58490","https://bugs.launchpad.net/glance/+bug/1135541","https://exchange.xforce.ibmcloud.com/vulnerabilities/82878","https://review.openstack.org/#/c/24437/","https://review.openstack.org/#/c/24438/","https://review.openstack.org/#/c/24439/","http://rhn.redhat.com/errata/RHSA-2013-0707.html","http://secunia.com/advisories/52565","http://www.ubuntu.com/usn/USN-1764-1","https://github.com/advisories/GHSA-c8w9-83vg-r8vv"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2013-46","url":"https://osv.dev/vulnerability/PYSEC-2013-46"}],"summary":"The v1 API in OpenStack Glance Essex (2012.1), Folsom (2012.2), and Grizzly, when using the single-tenant Swift or S3 store, reports the location field, which allows remote authenticated users to obta"}