What’s Vulnerable › Vulnerabilities

CVE-2013-4222

• Severity: medium (CVSS 6.5 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2013-09-30 · updated 2026-06-16
• Weakness: CWE-522

Description

OpenStack Identity (Keystone) Folsom, Grizzly 2013.1.3 and earlier, and Havana before havana-3 does not properly revoke user tokens when a tenant is disabled, which allows remote authenticated users to retain access via the token.

Affected products

• Canonical Ubuntu Linux: 12.10, 13.04
• Fedoraproject Fedora: 20
• OpenStack Keystone: from 2013.1 through 2013.1.3
• OpenStack: 3.0

References

• http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116489.html
• http://rhn.redhat.com/errata/RHSA-2013-1524.html
• http://www.ubuntu.com/usn/USN-2002-1
• https://bugs.launchpad.net/ossn/+bug/1179955
• http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116489.html
• http://rhn.redhat.com/errata/RHSA-2013-1524.html
• http://www.ubuntu.com/usn/USN-2002-1
• https://bugs.launchpad.net/ossn/+bug/1179955

Get alerted when CVE-2013-4222 or the next vulnerability affects your stack