Em resumo
- CVE-2012-4456 é uma vulnerabilidade ALTO (CVSS 7.5) que afeta keystone, keystone (openstack).
- Chance de exploração nos próximos 30 dias (EPSS): 4.0%, maior que 90.5% das vulnerabilidades.
- Correção: atualize para 2012.1.2 ou posterior.
| Package | Affected versions | Patched versions |
|---|
| keystone PyPI | ≥ 2012.1, < 2012.1.2
| 2012.1.2
|
| keystone | = 2012.2≥ 2012.1, < 2012.1.2
| 2012.1.2
|
Description
The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services.
NVD description
The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free