CVE-2013-6428 Information

Description

The ReST API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 allows remote authenticated users to bypass the tenant scoping restrictions via a modified tenant_id in the request path.

Reference

http://rhn.redhat.com/errata/RHSA-2014-0090.html http://seclists.org/oss-sec/2013/q4/479 https://launchpad.net/bugs/1256983