CVE-2012-5571CWE-639

Openstack keystone: openstack keystone: authorization bypass via improper ec2 token handling

Medium · published December 18, 2012

CVSS v3.1
5.4
EPSS
2%
Percentile
81.0
In the wild
Unconfirmed
What it is

A flaw was found in OpenStack Keystone. This vulnerability allows remote authenticated users to bypass intended authorization restrictions. This occurs because OpenStack Keystone does not properly handle EC2 (Elastic Compute Cloud) tokens when a user's role has been removed from a tenant. An attacker can leverage a token associated with a removed user role to gain unauthorized access.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.02055 · 81.0th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2012-12-18T01:00Z
EPSS history
Timeline
  • 18 DEC 01:00Z
    Openstack keystone: openstack keystone: authorization bypass via improper ec2 token handling
    cvelistv5