En bref
- CVE-2012-4456 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant keystone, keystone (openstack).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 4.0%, plus élevée que 90.5% des vulnérabilités.
- Correctif : mettre à jour vers 2012.1.2 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| keystone PyPI | ≥ 2012.1, < 2012.1.2
| 2012.1.2
|
| keystone | = 2012.2≥ 2012.1, < 2012.1.2
| 2012.1.2
|
Description
The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services.
NVD description
The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free