Vulnerability Database

289,599

Total vulnerabilities in the database

CVE-2013-6391

The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows remote trust users to gain privileges by generating EC2 credentials from a trust-scoped token and using them in an ec2tokens API request.

  • Published: Dec 14, 2013
  • Updated: Apr 13, 2023
  • CVE: CVE-2013-6391
  • Severity: Medium
  • Exploit:

CVSS v2:

  • Severity: Medium
  • Score: 5.8
  • AV:N/AC:M/Au:N/C:P/I:P/A:N

CWEs:

Software From Fixed in
openstack / keystone 2013.2 2013.2.1
canonical / ubuntu_linux 13.10 13.10.x
redhat / openstack 4.0 4.0.x