CVE-2013-6391

OpenStack Keystone < 2013.2.1 - Privilege Escalation via EC2 Tokens API

Title source: llm
STIX 2.1

Description

The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows remote trust users to gain privileges by generating EC2 credentials from a trust-scoped token and using them in an ec2tokens API request.

References (8)

Core 8
Core References
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2061-1
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/64253
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2013/12/11/7
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/56154
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/56079
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2014-0089.html
Exploit, Issue Tracking, Third Party Advisory x_refsource_confirm
https://bugs.launchpad.net/keystone/+bug/1242597
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/89657

Scores

EPSS 0.0050
EPSS Percentile 66.1%

Details

CWE
CWE-269
Status published
Products (3)
canonical/ubuntu_linux 13.10
openstack/keystone 2013.2 - 2013.2.1
redhat/openstack 4.0
Published Dec 14, 2013
Tracked Since Feb 18, 2026