CVE-2012-5571 — פרטי פגיעות

תיאור (מקור, אנגלית)

A flaw was found in OpenStack Keystone. This vulnerability allows remote authenticated users to bypass intended authorization restrictions. This occurs because OpenStack Keystone does not properly handle EC2 (Elastic Compute Cloud) tokens when a user's role has been removed from a tenant. An attacker can leverage a token associated with a removed user role to gain unauthorized access.

מדדים

CVSS 3.1: 5.4 (MEDIUM) מקור הציון: CNA CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
EPSS — סבירות ניצול: 2% (אחוזון 81) נכון ל-1 בנובמבר 2026
CWE: CWE-639, CWE-255

מוצרים מושפעים

openstack: essex; openstack: folsom

קישורים

http://secunia.com/advisories/51423 Vendor Advisory
http://secunia.com/advisories/51436 Vendor Advisory
http://secunia.com/advisories/51423 Vendor Advisory
http://secunia.com/advisories/51436 Vendor Advisory
http://www.openwall.com/lists/oss-security/2012/11/28/5 Patch
http://www.openwall.com/lists/oss-security/2012/11/28/6 Patch
https://bugs.launchpad.net/keystone/+bug/1064914 Patch
https://github.com/openstack/keystone/commit/37308dd4f3e33f7bd0f71d83fd51734d1‮… Patch
https://github.com/openstack/keystone/commit/8735009dc5b895db265a1cd573f39f4ac‮… Patch
https://github.com/openstack/keystone/commit/9d68b40cb9ea818c48152e6c712ff4158‮… Patch

תיאור (מקור, אנגלית)

מדדים

מוצרים מושפעים

קישורים

נגישות