CVE-2013-0282: OpenStack Keystone allows… – CVSS 5.0 · Watchpost

← All vulnerabilities

OpenStack Keystone allows context-dependent attackers to bypass access restrictions

中危 5.0CVE-2013-0282 · GHSA-8833-qrvm-wc3h · PYSEC-2026-652 · Published 12/04/2013 · updated 16/06/2026

要点

CVE-2013-0282 是影响 keystone, keystone (openstack) 的中危 (CVSS 5.0)漏洞。
未来 30 天内被利用的概率（EPSS）：1.8%，高于 78.0% 的漏洞。
修复：升级到 8.0.0a0 或更高版本。

Package	Affected versions	Patched versions
keystone PyPI	`< 8.0.0a0`	`8.0.0a0`
keystone openstack	`= 2013.1≥ 2012.1, ≤ 2012.1.3≥ 2012.2, ≤ 2012.2.4`	No fix yet

Description

OpenStack Keystone Grizzly before 2013.1, Folsom 2012.1.3 and earlier, and Essex does not properly check if the (1) user, (2) tenant, or (3) domain is enabled when using EC2-style authentication, which allows context-dependent attackers to bypass access restrictions.

NVD description

OpenStack Keystone Grizzly before 2013.1, Folsom 2012.1.3 and earlier, and Essex does not properly check if the (1) user, (2) tenant, or (3) domain is enabled when using EC2-style authentication, which allows context-dependent attackers to bypass access restrictions.

References

nvd.nist.gov/vuln/detail/CVE-2013-0282 · ADVISORY
openstack/keystone commit 7402f5e · WEB
openstack/keystone commit 9572bfc · WEB
openstack/keystone commit f0b4d30 · WEB
bugs.launchpad.net/keystone/+bug/1121494 · WEB
launchpad.net/keystone/+milestone/2012.2.4 · WEB
launchpad.net/keystone/grizzly/2013.1 · WEB
review.openstack.org · WEB
review.openstack.org · WEB
review.openstack.org · WEB
openwall.com/lists/oss-security/2013/02/19/3 · WEB
review.openstack.org · Vendor Advisory

keystone 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free