CVE-2012-4413

OpenStack Keystone < 2012.1.3 - Authenticated Privilege Retention via Token Invalidation Bypass

Title source: llm
STIX 2.1

Description

OpenStack Keystone 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles.

References (7)

Core 7
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/85484
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/50531
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2012/09/12/7
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/78478
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-1564-1
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/55524
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/50590

Scores

EPSS 0.0043
EPSS Percentile 62.6%

Details

CWE
CWE-264
Status published
Products (2)
openstack/keystone 2012.1.3
pypi/keystone 0 - 2012.1.3PyPI
Published Sep 18, 2012
Tracked Since Feb 18, 2026