CVE-2013-0282

CWE-287 — Improper Authentication11 documents8 sources
Severity
5.0MEDIUM
EPSS
0.5%
top 35.58%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Openstack Keystone
Timeline
PublishedApr 12
Latest updateMay 5

Description

OpenStack Keystone Grizzly before 2013.1, Folsom 2012.1.3 and earlier, and Essex does not properly check if the (1) user, (2) tenant, or (3) domain is enabled when using EC2-style authentication, which allows context-dependent attackers to bypass access restrictions.

CVSS vector

AV:N/AC:L/C:P/I:N/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages4 packages

▶NVDopenstack/keystone2012.1 — 2012.1.3+2
▶PyPIKeystone< 8.0.0a0
▶PyPIkeystone< 8.0.0a0
▶Debiankeystone< 2012.1.1-13+3

🔴Vulnerability Details

4
OSV
OpenStack Keystone allows context-dependent attackers to bypass access restrictions↗2022-05-05
▶
GHSA
OpenStack Keystone allows context-dependent attackers to bypass access restrictions↗2022-05-05
▶
CVEList
CVE-2013-0282: OpenStack Keystone Grizzly before 2013↗2013-04-12
▶
OSV
CVE-2013-0282: OpenStack Keystone Grizzly before 2013↗2013-04-12
▶

📋Vendor Advisories

3
Ubuntu
OpenStack Keystone vulnerabilities↗2013-02-20
▶
Red Hat
Keystone: EC2-style authentication accepts disabled user/tenants↗2013-02-19
▶
Debian
CVE-2013-0282: keystone - OpenStack Keystone Grizzly before 2013.1, Folsom 2012.1.3 and earlier, and Essex...↗2013
▶

💬Community

3
Bugzilla
CVE-2013-0282 OpenStack Keystone: EC2-style authentication accepts disabled user/tenants [epel-6]↗2013-02-19
▶
Bugzilla
CVE-2013-0282 OpenStack Keystone: EC2-style authentication accepts disabled user/tenants [fedora-all]↗2013-02-19
▶
Bugzilla
CVE-2013-0282 OpenStack Keystone: EC2-style authentication accepts disabled user/tenants↗2013-02-13
▶