CVE - CVE-2012-4457

CVE-ID
CVE-2012-4457	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-3 does not properly handle authorization tokens for disabled tenants, which allows remote authenticated users to access the tenant's resources by requesting a token for the tenant.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:50665 URL:http://secunia.com/advisories/50665 MISC:55716 URL:http://www.securityfocus.com/bid/55716 MISC:[openstack] 20120928 [OSSA 2012-016] Token authorization for a user in a disabled tenant is allowed (CVE-2012-4457) URL:https://lists.launchpad.net/openstack/msg17035.html MISC:[oss-security] 20120928 [OSSA 2012-016] Token authorization for a user in a disabled tenant is allowed (CVE-2012-4457) URL:http://www.openwall.com/lists/oss-security/2012/09/28/6 MISC:https://bugzilla.redhat.com/show_bug.cgi?id=861180 URL:https://bugzilla.redhat.com/show_bug.cgi?id=861180 MISC:https://github.com/openstack/keystone/commit/4ebfdfaf23c6da8e3c182bf3ec2cb2b7132ef685 URL:https://github.com/openstack/keystone/commit/4ebfdfaf23c6da8e3c182bf3ec2cb2b7132ef685 MISC:https://github.com/openstack/keystone/commit/5373601bbdda10f879c08af1698852142b75f8d5 URL:https://github.com/openstack/keystone/commit/5373601bbdda10f879c08af1698852142b75f8d5 MISC:keystone-xauth-token-sec-bypass(78947) URL:https://exchange.xforce.ibmcloud.com/vulnerabilities/78947
Assigning CNA
Red Hat, Inc.
Date Record Created
20120821	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20120821)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)