GoogleOSV:GHSA-F889-WFWM-6P7MOpenStack Identity Keystone Privilege Escalation vulnerability
6.6 Medium
AI Score
Confidence
Low
3.3 Low
CVSS2
Access Vector
LOCAL
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:L/AC:M/Au:N/C:P/I:P/A:N
0.0004 Low
EPSS
Percentile
5.3%
The LDAP backend in OpenStack Identity (Keystone) Grizzly and Havana, when removing a role on a tenant for a user who does not have that role, adds the role to the user, which allows local users to gain privileges.
References
rhn.redhat.com/errata/RHSA-2014-0113.html
www.openwall.com/lists/oss-security/2013/10/30/6
www.ubuntu.com/usn/USN-2034-1
bugs.launchpad.net/keystone/+bug/1242855
github.com/openstack/keystone
github.com/openstack/keystone/commit/b17e7bec768bd53d3977352486378698a3db3cfa
github.com/openstack/keystone/commit/c6800ca1ac984c879e75826df6694d6199444ea0
nvd.nist.gov/vuln/detail/CVE-2013-4477
Related
6.6 Medium
AI Score
Confidence
Low
3.3 Low
CVSS2
Access Vector
LOCAL
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:L/AC:M/Au:N/C:P/I:P/A:N
0.0004 Low
EPSS
Percentile
5.3%