CVE-2012-3426

2012-07-3110:45:42

CWE-264

[email protected]

web.nvd.nist.gov

openstack

keystone

token expiration

authentication

authorization

nvd

cve-2012-3426

4.9 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:P/A:N

6.1 Medium

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

65.3%

JSON

OpenStack Keystone before 2012.1.1, as used in OpenStack Folsom before Folsom-1 and OpenStack Essex, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by (1) creating new tokens through token chaining, (2) leveraging possession of a token for a disabled user account, or (3) leveraging possession of a token for an account with a changed password.

Affected configurations

NVD

Node

openstackessex

openstackhorizonMatchfolsom-1

openstackkeystoneMatch2012.1

openstackkeystoneMatch2012.1.1

CPENameOperatorVersion
openstack:essexopenstack essexeq*
openstack:horizonopenstack horizoneqfolsom-1
openstack:keystoneopenstack keystoneeq2012.1
openstack:keystoneopenstack keystoneeq2012.1.1

CPE	Name	Operator	Version
openstack:essex	openstack essex	eq	*
openstack:horizon	openstack horizon	eq	folsom-1
openstack:keystone	openstack keystone	eq	2012.1
openstack:keystone	openstack keystone	eq	2012.1.1