CVE-2012-4456

The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token…

published October 9, 2012

CVSS
—
EPSS
4%
Percentile
90.4
In the wild
Unconfirmed
What it is

The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03998 · 90.4th percentile
Published
2012-10-09T15:00Z
EPSS history
Timeline
  • 09 OCT 15:00Z
    The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token…
    cvelistv5