Unscored severity · published Dec 18, 2012
CVE-2012-5563
OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization…
–
CVSS
2.9%
EPSS
No
On KEV
Description
OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by creating new tokens through token chaining. NOTE: this issue exists because of a CVE-2012-3426 regression.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.9% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
Folsom · Openstack
2012.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-5563
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-5563
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2012-1557.html
Vendor Advisory
http://secunia.com/advisories/51423
Vendor Advisory
http://secunia.com/advisories/51436
Patch
http://www.openwall.com/lists/oss-security/2012/11/28/5
Patch
http://www.openwall.com/lists/oss-security/2012/11/28/6
www.securityfocus.com
http://www.securityfocus.com/bid/56727
More from Folsom
8.8
CVE-2013-0261
A flaw was found in PackStack
7.6
CVE-2013-0335
OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to gain access to a VM in opportunistic circumstances by using the VNC…
5.5
CVE-2013-0266
A flaw was found in the `puppetlabs-cinder` module, as used in PackStack
5.4
CVE-2012-5571
A flaw was found in OpenStack Keystone
–
CVE-2013-4463
OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file…