CVE-2012-4413

Severity: medium (CVSS 4.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-09-18 · updated 2026-06-16
Weakness: CWE-264

Description

OpenStack Keystone 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles.

Affected products

OpenStack Keystone: 2012.1.3

References

http://osvdb.org/85484
http://secunia.com/advisories/50531
http://secunia.com/advisories/50590
http://www.openwall.com/lists/oss-security/2012/09/12/7
http://www.securityfocus.com/bid/55524
http://www.ubuntu.com/usn/USN-1564-1
https://exchange.xforce.ibmcloud.com/vulnerabilities/78478
http://osvdb.org/85484
http://secunia.com/advisories/50531
http://secunia.com/advisories/50590
http://www.openwall.com/lists/oss-security/2012/09/12/7
http://www.securityfocus.com/bid/55524

Get alerted when CVE-2012-4413 or the next vulnerability affects your stack