CVE-2012-4413 - Vulnerability Details - OpenCVE

OpenStack Keystone 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00428.

Key SSVC decision points have not yet been added.

Vendors	Products
Openstack	Keystone
Redhat	Openstack

Configuration 1 [-]

cpe:2.3:a:openstack:keystone:2012.1.3:*:*:*:*:*:*:*

Package	CPE	Advisory	Released Date
OpenStack Essex for RHEL 6
openstack-keystone-0:2012.1.2-4.el6	cpe:/a:redhat:openstack:1::el6	RHSA-2012:1378	2012-10-16T00:00:00Z

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2022-4623	OpenStack Keystone 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles.
Github GHSA	GHSA-mrxv-65rv-6hxq	OpenStack Keystone does not invalidate existing tokens when granting or revoking roles
Ubuntu USN	USN-1564-1	OpenStack Keystone vulnerability

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://osvdb.org/85484
http://secunia.com/advisories/50531
http://secunia.com/advisories/50590
http://www.openwall.com/lists/oss-security/2012/09/12/7
http://www.securityfocus.com/bid/55524
http://www.ubuntu.com/usn/USN-1564-1
https://exchange.xforce.ibmcloud.com/vulnerabilities/78478
https://nvd.nist.gov/vuln/detail/CVE-2012-4413
https://www.cve.org/CVERecord?id=CVE-2012-4413

History

No history.

MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2012-09-18T17:00:00

Updated: 2024-08-06T20:35:09.517Z

Reserved: 2012-08-21T00:00:00

Link: CVE-2012-4413

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2012-09-18T17:55:07.960

Modified: 2025-04-11T00:51:21.963

Link: CVE-2012-4413

Redhat

Severity : Moderate

Publid Date: 2012-09-12T00:00:00Z

Links: CVE-2012-4413 - Bugzilla

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2012-09-12T00:00:00", "descriptions": [{"lang": "en", "value": "OpenStack Keystone 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-28T12:57:01", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"name": "85484", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/85484"}, {"name": "50531", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/50531"}, {"name": "[oss-security] 20120912 [OSSA 2012-014] Revoking a role does not affect existing tokens (CVE-2012-4413)", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2012/09/12/7"}, {"name": "keystone-roles-sec-bypass(78478)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/78478"}, {"name": "USN-1564-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "http://www.ubuntu.com/usn/USN-1564-1"}, {"name": "55524", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/55524"}, {"name": "50590", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/50590"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T20:35:09.517Z"}, "title": "CVE Program Container", "references": [{"name": "85484", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/85484"}, {"name": "50531", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/50531"}, {"name": "[oss-security] 20120912 [OSSA 2012-014] Revoking a role does not affect existing tokens (CVE-2012-4413)", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2012/09/12/7"}, {"name": "keystone-roles-sec-bypass(78478)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/78478"}, {"name": "USN-1564-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "http://www.ubuntu.com/usn/USN-1564-1"}, {"name": "55524", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/55524"}, {"name": "50590", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/50590"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2012-4413", "datePublished": "2012-09-18T17:00:00", "dateReserved": "2012-08-21T00:00:00", "dateUpdated": "2024-08-06T20:35:09.517Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openstack:keystone:2012.1.3:*:*:*:*:*:*:*", "matchCriteriaId": "92047E47-C052-4979-9F6C-00E88CE098A1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenStack Keystone 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles."}, {"lang": "es", "value": "OpenStack Keystone v2012.1.3 no invalida los tokens existentes cuando permite o deniega los roles, lo que permite a usuarios autenticados remotamente mantener los privilegios de los roles eliminados."}], "id": "CVE-2012-4413", "lastModified": "2025-04-11T00:51:21.963", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2012-09-18T17:55:07.960", "references": [{"source": "secalert@redhat.com", "url": "http://osvdb.org/85484"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/50531"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/50590"}, {"source": "secalert@redhat.com", "url": "http://www.openwall.com/lists/oss-security/2012/09/12/7"}, {"source": "secalert@redhat.com", "url": "http://www.securityfocus.com/bid/55524"}, {"source": "secalert@redhat.com", "url": "http://www.ubuntu.com/usn/USN-1564-1"}, {"source": "secalert@redhat.com", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/78478"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/85484"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/50531"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/50590"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2012/09/12/7"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/55524"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.ubuntu.com/usn/USN-1564-1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/78478"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-264"}], "source": "nvd@nist.gov", "type": "Primary"}]}