CVE-2014-3520

MEDIUM 6.5CVE-2014-3520 · Published 26/10/2014 · updated 17/06/2026

In short

CVE-2014-3520 is a MEDIUM (CVSS 6.5) vulnerability affecting keystone (openstack).
Chance of exploitation in the next 30 days (EPSS): 1.9%, higher than 79.8% of all vulnerabilities.
Fix: update to 2013.2.4, 2014.1.2 or later.

Package	Affected versions	Patched versions
keystone openstack	`≥ 2013.2, < 2013.2.4≥ 2014.1, < 2014.1.2`	`2013.2.42014.1.2`

Description

OpenStack Identity (Keystone) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticated trustees to gain access to an unauthorized project for which the trustor has certain roles via the project ID in a V2 API trust token request.

References

lists.openstack.org/pipermail/openstack-announce/2014-July/000248.html · Patch
secunia.com/advisories/59426 · Third Party Advisory
bugs.launchpad.net/keystone/+bug/1331912 · Exploit

More vulnerabilities in keystone

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

keystone

openstack

≥ 2013.2, < 2013.2.4≥ 2014.1, < 2014.1.2

2013.2.42014.1.2

More vulnerabilities in keystone

See all →