{"action":"Upgrade glance to 2012.1.1-5 or later.","affected":[{"fixed":"2012.1.1-5","introduced":"0"}],"component":"glance","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:12","exploited":false,"fixed_versions":["2012.1.1-5"],"id":"tcs_01M5NAB61VWD38D98YFM256QVY","modified_at":"2026-10-31T04:00:04.619963039Z","published_at":"2013-03-22T21:55:01.487Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2013-1840","https://security-tracker.debian.org/tracker/CVE-2013-1840"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2013-1840","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2013-1840"}],"summary":"The v1 API in OpenStack Glance Essex (2012.1), Folsom (2012.2), and Grizzly, when using the single-tenant Swift or S3 store, reports the location field, which allows remote authenticated users to obta"}