Lucene search
HistoryOct 26, 2014 - 8:55 p.m.
CVE-2014-3520
cve-2014-3520
openstack identity
keystone
remote access
unauthorized project
trustee
api
security vulnerability
6.5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
6.4 Medium
AI Score
Confidence
Low
0.006 Low
EPSS
Percentile
78.0%
OpenStack Identity (Keystone) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticated trustees to gain access to an unauthorized project for which the trustor has certain roles via the project ID in a V2 API trust token request.
Affected configurations
Node
openstackkeystoneRange2013.2–2013.2.4
ORopenstackkeystoneRange2014.1–2014.1.2
| CPE | Name | Operator | Version |
|---|---|---|---|
| openstack:keystone | openstack keystone | lt | 2013.2.4 |
| openstack:keystone | openstack keystone | lt | 2014.1.2 |
Related
nvd
nvd
CVE-2014-3520
2014-10-26 20:55:02
nessus
nessus
Oracle Solaris Third-Party Patch Update : keystone (cve_2014_3520_privilege_escalation)
2015-01-19 00:00:00
Fedora 20 : openstack-keystone-2013.2.3-5.fc20 (2014-5497)
2014-08-08 00:00:00
Ubuntu 14.04 LTS : OpenStack Keystone vulnerabilities (USN-2324-1)
2014-08-22 00:00:00
ibm
ibm
veracode
veracode
Privilege Escalation
2019-05-02 05:05:14
cvelist
cvelist
CVE-2014-3520
2014-10-26 20:00:00
ubuntucve
ubuntucve
CVE-2014-3520
2014-07-02 00:00:00
debiancve
debiancve
CVE-2014-3520
2014-10-26 20:55:02
prion
prion
Cross site request forgery (csrf)
2014-10-26 20:55:00
redhat
redhat
(RHSA-2014:0994) Important: openstack-keystone security update
2014-07-31 00:00:00
openvas
openvas
Ubuntu: Security Advisory (USN-2324-1)
2014-08-22 00:00:00
Fedora Update for openstack-keystone FEDORA-2014-5497
2014-08-08 00:00:00
ubuntu
ubuntu
OpenStack Keystone vulnerabilities
2014-08-21 00:00:00
securityvulns
securityvulns
[USN-2324-1] OpenStack Keystone vulnerabilities
2014-08-24 00:00:00
fedora
fedora
[SECURITY] Fedora 20 Update: openstack-keystone-2013.2.3-5.fc20
2014-08-07 15:24:24
6.5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
6.4 Medium
AI Score
Confidence
Low
0.006 Low
EPSS
Percentile
78.0%
Related for CVE-2014-3520