Unscored severity · published Jul 31, 2012
CVE-2012-3426
OpenStack Keystone before 2012.1.1, as used in OpenStack Folsom before Folsom-1 and OpenStack Essex, does not properly implement token expiration, which allows remote…
–
CVSS
2.3%
EPSS
No
On KEV
Description
OpenStack Keystone before 2012.1.1, as used in OpenStack Folsom before Folsom-1 and OpenStack Essex, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by (1) creating new tokens through token chaining, (2) leveraging possession of a token for a disabled user account, or (3) leveraging possession of a token for an account with a changed password.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
Essex · Openstack
All versions, or not specified · source: NVD
HO
Horizon · Openstack
folsom-1 · source: NVD
KE
Keystone · Openstack
2012.1; 2012.1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-3426
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-3426
github.com
http://github.com/openstack/keystone/commit/29e74e73a6e51cffc0371b32354558391826a4aa
Patch
http://github.com/openstack/keystone/commit/375838cfceb88cacc312ff6564e64eb18ee6a355
Exploit
http://github.com/openstack/keystone/commit/628149b3dc6b58b91fd08e6ca8d91c728ccb8626
github.com
http://github.com/openstack/keystone/commit/a67b24878a6156eab17b9098fa649f0279256f5d
github.com
http://github.com/openstack/keystone/commit/d9600434da14976463a0bd03abd8e0309f0db454
Exploit
http://github.com/openstack/keystone/commit/ea03d05ed5de0c015042876100d37a6a14bf56de
More from Essex
8.8
CVE-2013-0261
A flaw was found in PackStack
7.6
CVE-2013-0335
OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to gain access to a VM in opportunistic circumstances by using the VNC…
5.5
CVE-2013-0266
A flaw was found in the `puppetlabs-cinder` module, as used in PackStack
5.4
CVE-2012-5571
A flaw was found in OpenStack Keystone
–
CVE-2013-1838
OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) does not properly implement a quota for fixed IPs, which allows remote authenticated users to cause a denial…