CVE-2014-5252

2014-08-2514:55:07

CWE-255

mitre

web.nvd.nist.gov

openstack

identity

keystone

v3 api

cve-2014-5252

security update

CVSS2

4.9

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:P/A:N

AI Score

6.2

Confidence

Low

EPSS

0.002

Percentile

53.9%

JSON

The V3 API in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 updates the issued_at value for UUID v2 tokens, which allows remote authenticated users to bypass the token expiration and retain access via a verification (1) GET or (2) HEAD request to v3/auth/tokens/.

Affected configurations

Nvd

Node

openstackkeystoneMatch2014.1

openstackkeystoneMatch2014.1.2

openstackkeystoneMatchjuno-1

openstackkeystoneMatchjuno-2

canonicalubuntu_linuxMatch14.04lts

VendorProductVersionCPE
openstackkeystone2014.1cpe:2.3:a:openstack:keystone:2014.1:*:*:*:*:*:*:*
openstackkeystone2014.1.2cpe:2.3:a:openstack:keystone:2014.1.2:*:*:*:*:*:*:*
openstackkeystonejuno-1cpe:2.3:a:openstack:keystone:juno-1:*:*:*:*:*:*:*
openstackkeystonejuno-2cpe:2.3:a:openstack:keystone:juno-2:*:*:*:*:*:*:*
canonicalubuntu_linux14.04cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*

Vendor	Product	Version	CPE
openstack	keystone	2014.1	cpe:2.3:a:openstack:keystone:2014.1:::::::*
openstack	keystone	2014.1.2	cpe:2.3:a:openstack:keystone:2014.1.2:::::::*
openstack	keystone	juno-1	cpe:2.3:a:openstack:keystone:juno-1:::::::*
openstack	keystone	juno-2	cpe:2.3:a:openstack:keystone:juno-2:::::::*
canonical	ubuntu_linux	14.04	cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::