Kurz gesagt
- CVE-2012-4456 ist eine Schwachstelle (HOCH (CVSS 7.5)) in keystone, keystone (openstack).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 4.0%, höher als bei 90.5% aller Schwachstellen.
- Abhilfe: auf 2012.1.2 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| keystone PyPI | ≥ 2012.1, < 2012.1.2
| 2012.1.2
|
| keystone | = 2012.2≥ 2012.1, < 2012.1.2
| 2012.1.2
|
Description
The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services.
NVD description
The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free