CVEvulnerability
CVE-2013-0282
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2013-04-12
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-287
Description
OpenStack Keystone Grizzly before 2013.1, Folsom 2012.1.3 and earlier, and Essex does not properly check if the (1) user, (2) tenant, or (3) domain is enabled when using EC2-style authentication, which allows context-dependent attackers to bypass access restrictions.
Affected configurations
• openstack keystone (>= 2012.1 <= 2012.1.3)
• openstack keystone (>= 2012.2 <= 2012.2.4)
• openstack keystone 2013.1
Related
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- http://www.openwall.com/lists/oss-security/2013/02/19/3 Third Party Advisory
- https://bugs.launchpad.net/keystone/+bug/1121494 Third Party Advisory
- https://launchpad.net/keystone/+milestone/2012.2.4 Third Party Advisory
- https://launchpad.net/keystone/grizzly/2013.1 Third Party Advisory
- https://review.openstack.org/#/c/22319/ Vendor Advisory
- https://review.openstack.org/#/c/22320/ Vendor Advisory
- https://review.openstack.org/#/c/22321/ Vendor Advisory
- http://www.openwall.com/lists/oss-security/2013/02/19/3 Third Party Advisory
- https://bugs.launchpad.net/keystone/+bug/1121494 Third Party Advisory
- https://launchpad.net/keystone/+milestone/2012.2.4 Third Party Advisory
- https://launchpad.net/keystone/grizzly/2013.1 Third Party Advisory
- https://review.openstack.org/#/c/22319/ Vendor Advisory
- https://review.openstack.org/#/c/22320/ Vendor Advisory
- https://review.openstack.org/#/c/22321/ Vendor Advisory