In short
- CVE-2012-4456 is a HIGH (CVSS 7.5) vulnerability affecting keystone, keystone (openstack).
- Chance of exploitation in the next 30 days (EPSS): 4.0%, higher than 90.5% of all vulnerabilities.
- Fix: update to 2012.1.2 or later.
| Package | Affected versions | Patched versions |
|---|
| keystone PyPI | ≥ 2012.1, < 2012.1.2
| 2012.1.2
|
| keystone | = 2012.2≥ 2012.1, < 2012.1.2
| 2012.1.2
|
Description
The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services.
NVD description
The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free