CVE-2012-4413

Published: Sep 18, 2012Modified: Apr 29, 2026

4.0

Vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Exploitability: 8.0 / Impact: 2.9

Source: NVD

Description

OpenStack Keystone 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles.

Affected (1)

Products: Openstack: Keystone

Openstack

1 product

Keystone

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Openstack Keystone	Version 2012.1.3

Related CWEs

CWE-264

References (14)

http://osvdb.org/85484

Source: secalert@redhat.com

http://secunia.com/advisories/50531

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/50590

Source: secalert@redhat.com

Vendor Advisory

http://www.openwall.com/lists/oss-security/2012/09/12/7

Source: secalert@redhat.com

http://www.securityfocus.com/bid/55524

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-1564-1

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/78478

Source: secalert@redhat.com

http://osvdb.org/85484