CVE-2012-4413

EUVD-2022-4623
OpenStack Keystone 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:S/C:N/I:P/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 62%
Affected Products (NVD)
VendorProductVersion
openstackkeystone
2012.1.3
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
keystone
bookworm
2:22.0.0-2
fixed
bullseye
2:18.0.0-3+deb11u1
fixed
sid
2:26.0.0-1
fixed
trixie
2:26.0.0-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
keystone
hardy
dne
lucid
dne
natty
dne
oneiric
ignored
precise
Fixed 2012.1+stable~20120824-a16a0ab9-0ubuntu2.2
released
quantal
not-affected
Common Weakness Enumeration
References
http://osvdb.org/85484
http://secunia.com/advisories/50531
http://secunia.com/advisories/50590
http://www.openwall.com/lists/oss-security/2012/09/12/7
http://www.securityfocus.com/bid/55524
http://www.ubuntu.com/usn/USN-1564-1
https://exchange.xforce.ibmcloud.com/vulnerabilities/78478
http://osvdb.org/85484
http://secunia.com/advisories/50531
http://secunia.com/advisories/50590
http://www.openwall.com/lists/oss-security/2012/09/12/7
http://www.securityfocus.com/bid/55524
http://www.ubuntu.com/usn/USN-1564-1
https://exchange.xforce.ibmcloud.com/vulnerabilities/78478