CVE-2012-4413: Medium severity Openstack Keystone vulnerability

Published Sep 18, 2012

Updated

OpenStack Keystone 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles.

Affected Software

1 affected component

Openstack Keystone=2012.1.3

Event History

Sep 18, 2012

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2012-4413?

CVE-2012-4413 is categorized as a high severity vulnerability due to its impact on role privileges in OpenStack Keystone.

How do I fix CVE-2012-4413?

To fix CVE-2012-4413, you should upgrade OpenStack Keystone to a newer version where the token invalidation issue has been resolved.

What are the consequences of CVE-2012-4413?

The consequences of CVE-2012-4413 include unauthorized access to privileges even after role revocation, potentially compromising system security.

Is CVE-2012-4413 exploitable remotely?

Yes, CVE-2012-4413 is exploitable remotely, allowing authenticated users to retain revoked privileges.

What versions of OpenStack Keystone are affected by CVE-2012-4413?

CVE-2012-4413 specifically affects OpenStack Keystone version 2012.1.3.