CVE-2013-0282

OpenStack Keystone Grizzly before 2013.1, Folsom 2012.1.3 and earlier, and Essex does not properly check if the (1) user, (2) tenant, or (3) domain is enabled when using EC2-style authentication, which allows context-dependent attackers to bypass access restrictions.

Published: Apr 13, 2013
Updated: Apr 13, 2023
CVE: CVE-2013-0282
Severity: Medium
Exploit:

CVSS v2:

Severity: Medium
Score: 5
AV:N/AC:L/Au:N/C:P/I:N/A:N

CWEs:

CWE-287

OWASP TOP 10:

A2 - Broken Authentication

Affected Software
References

Software	From	Fixed in
openstack / keystone	2012.1	2012.1.3.x
openstack / keystone	2012.2	2012.2.4.x
openstack / keystone	2013.1-milestone1	2013.1-milestone1.x
openstack / keystone	2013.1-milestone2	2013.1-milestone2.x
openstack / keystone	2013.1-milestone3	2013.1-milestone3.x

http://www.openwall.com/lists/oss-security/2013/02/19/3
https://bugs.launchpad.net/keystone/+bug/1121494
https://launchpad.net/keystone/+milestone/2012.2.4
https://launchpad.net/keystone/grizzly/2013.1
https://review.openstack.org/#/c/22319/
https://review.openstack.org/#/c/22320/
https://review.openstack.org/#/c/22321/

Vulnerability Database

289,697

CVE-2013-0282