En resumen
- CVE-2012-4456 es una vulnerabilidad ALTO (CVSS 7.5) que afecta a keystone, keystone (openstack).
- Probabilidad de explotación en los próximos 30 días (EPSS): 4.0%, mayor que el 90.5% de las vulnerabilidades.
- Solución: actualizar a 2012.1.2 o posterior.
| Package | Affected versions | Patched versions |
|---|
| keystone PyPI | ≥ 2012.1, < 2012.1.2
| 2012.1.2
|
| keystone | = 2012.2≥ 2012.1, < 2012.1.2
| 2012.1.2
|
Description
The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services.
NVD description
The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free