CVEvulnerability

CVE-2012-5571

5.4 MEDIUM Published 2012-12-18 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2012-12-18
Last modified
2026-06-16
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS 2.0 ([email protected])
3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
Weaknesses
CWE-255, CWE-639

Description

A flaw was found in OpenStack Keystone. This vulnerability allows remote authenticated users to bypass intended authorization restrictions. This occurs because OpenStack Keystone does not properly handle EC2 (Elastic Compute Cloud) tokens when a user's role has been removed from a tenant. An attacker can leverage a token associated with a removed user role to gain unauthorized access.

Affected configurations

• openstack essex 2012.1 • openstack folsom 2012.2

Related

Weakness · not in database (1)

Weakness · CWE (1)

  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References