Description
OpenStack Identity (Keystone) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 does not properly handle chained delegation, which allows remote authenticated users to gain privileges by leveraging a (1) trust or (2) OAuth token with impersonation enabled to create a new token with additional roles.
CVSS vector
AV:N/AC:M/C:P/I:P/A:PExploitability: 6.8 | Impact: 6.4 Affected Packages5 packages
▶Ubuntukeystone< 1:2014.1.2.1-0ubuntu1.1 🔴Vulnerability Details
5GHSAOpenStack Identity Keystone is vulnerable to Block delegation escalation of privilege↗2022-05-13 OSVOpenStack Identity Keystone is vulnerable to Block delegation escalation of privilege↗2022-05-13 OSVkeystone vulnerabilities↗2014-08-21 OSVCVE-2014-3476: OpenStack Identity (Keystone) before 2013↗2014-06-17 CVEListCVE-2014-3476: OpenStack Identity (Keystone) before 2013↗2014-06-17 📋Vendor Advisories
3UbuntuOpenStack Keystone vulnerabilities↗2014-08-21 Red Hatopenstack-keystone: privilege escalation through trust chained delegation↗2014-06-12 DebianCVE-2014-3476: keystone - OpenStack Identity (Keystone) before 2013.2.4, 2014.1 before 2014.1.2, and Juno ...↗2014 💬Community
3BugzillaCVE-2014-3476 openstack-keystone: privilege escalation through trust chained delegation [epel-6]↗2014-06-13 BugzillaCVE-2014-3476 openstack-keystone: privilege escalation through trust chained delegation [fedora-all]↗2014-06-13 BugzillaCVE-2014-3476 openstack-keystone: privilege escalation through trust chained delegation↗2014-06-04