CVE-2012-4456: OpenStack Keystone Improper Authentication… – CVSS 7.5 · Watchpost

← All vulnerabilities

OpenStack Keystone Improper Authentication vulnerability

높음 7.5CVE-2012-4456 · GHSA-mf98-r2gf-2x3w · PYSEC-2026-832 · Published 09/10/2012 · updated 16/06/2026

요약

CVE-2012-4456은(는) keystone, keystone (openstack)에 영향을 주는 높음 (CVSS 7.5) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 4.0%, 전체 취약점의 90.5%보다 높음.
조치: 2012.1.2 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
keystone PyPI	`≥ 2012.1, < 2012.1.2`	`2012.1.2`
keystone openstack	`= 2012.2≥ 2012.1, < 2012.1.2`	`2012.1.2`

Description

The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services.

NVD description

The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services.

References

nvd.nist.gov/vuln/detail/CVE-2012-4456 · ADVISORY
openstack/keystone commit 14b136a · WEB
openstack/keystone commit 1d146f5 · WEB
openstack/keystone commit 24df3ad · WEB
openstack/keystone commit 8680549 · WEB
access.redhat.com/errata/RHSA-2012:1378 · WEB
access.redhat.com/security/cve/CVE-2012-4456 · WEB
bugs.launchpad.net/keystone/+bug/1006815 · WEB
bugs.launchpad.net/keystone/+bug/1006822 · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
exchange.xforce.ibmcloud.com/vulnerabilities/78944 · WEB

keystone의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free