CVE-2012-4456
OpenStack Keystone Improper Authentication vulnerability
EPSS 4.0%
Description
The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services.
How to fix CVE-2012-4456
To remediate CVE-2012-4456, upgrade the affected package to a fixed version below.
- Debian/keystone—upgrade to 2012.1.1-9 or later
- PyPI/keystone—upgrade to 2012.1.2 or later
Is CVE-2012-4456 being exploited?
Low — EPSS is 4.0%, meaning exploitation activity has not been observed at scale.
Affected packages (2)
- from 0, < 2012.1.1-9
- >= 2012.1, < 2012.1.2