CVE Feed

    Dashboard / CVE / CVE-2012-4456

    CVE-2012-4456

    The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services.

    Published:May 31, 2012
    Last Modified:Apr 11, 2025
    EPS:Oct 9, 2012
    EPSS Score:0.0395
    CVSS Score:7.5

    Affected Products

    Vendor
    Openstack
    Product
    Keystone
    Vendor
    Redhat
    Product
    Openstack

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-80183 (CVSS 7.1) — In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every …
    CVE-2026-80184 (CVSS 7.6) — In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access to…
    CVE-2026-80182 (CVSS 7.6) — In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application credential, or trust…
    CVE-2026-2035364 (CVSS 8.1) — A flaw was found in OpenStack Keystone where delegation boundary enforcement is incomplete across trust, appli…
    CVE-2026-42999 (CVSS 6) — An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in enforce_call…
    CVE-2026-43000 (CVSS 6) — An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impe…
    CVE-2026-42998 (CVSS 6) — An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone application credential authenticatio…
    CVE-2026-44394 (CVSS 6) — An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism …
    CVE-2026-43001 (CVSS 7.9) — An issue was discovered in OpenStack Keystone before 29.0.2. POST /v3/credentials did not validate that the ca…
    CVE-2026-40683 (CVSS 7.7) — In OpenStack Keystone before 28.0.1, the LDAP identity backend does not convert the user enabled attribute to …

    References

    http://secunia.com/advisories/50665
    http://www.openwall.com/lists/oss-security/2012/09/28/5
    http://www.securityfocus.com/bid/55716
    https://bugs.launchpad.net/keystone/+bug/1006815
    https://bugs.launchpad.net/keystone/+bug/1006822
    https://bugzilla.redhat.com/show_bug.cgi?id=861179
    https://exchange.xforce.ibmcloud.com/vulnerabilities/78944
    https://github.com/openstack/keystone/commit/14b136aed9d988f5a8f3e699bd4577c9b874d6c1
    https://github.com/openstack/keystone/commit/1d146f5c32e58a73a677d308370f147a3271c2cb
    https://github.com/openstack/keystone/commit/24df3adb3f50cbb5ada411bc67aba8a781e6a431
    https://github.com/openstack/keystone/commit/868054992faa45d6f42d822bf1588cb88d7c9ccb
    https://lists.launchpad.net/openstack/msg17034.html
    http://secunia.com/advisories/50665
    http://www.openwall.com/lists/oss-security/2012/09/28/5
    http://www.securityfocus.com/bid/55716
    https://bugs.launchpad.net/keystone/+bug/1006815
    https://bugs.launchpad.net/keystone/+bug/1006822
    https://bugzilla.redhat.com/show_bug.cgi?id=861179
    https://exchange.xforce.ibmcloud.com/vulnerabilities/78944
    https://github.com/openstack/keystone/commit/14b136aed9d988f5a8f3e699bd4577c9b874d6c1
    https://github.com/openstack/keystone/commit/1d146f5c32e58a73a677d308370f147a3271c2cb
    https://github.com/openstack/keystone/commit/24df3adb3f50cbb5ada411bc67aba8a781e6a431
    https://github.com/openstack/keystone/commit/868054992faa45d6f42d822bf1588cb88d7c9ccb
    https://lists.launchpad.net/openstack/msg17034.html

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High