CVE-2014-0204

Severity: medium (CVSS 6.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-11-03 · updated 2026-06-17
Weakness: CWE-269

Description

OpenStack Identity (Keystone) before 2014.1.1 does not properly handle when a role is assigned to a group that has the same ID as a user, which allows remote authenticated users to gain privileges that are assigned to a group with the same ID.

Affected products

OpenStack Keystone: from 2014.1 before 2014.1.1 — fixed in 2014.1.1

How to fix

Upgrade to a fixed version: OpenStack Keystone 2014.1.1. Check the vendor advisory for mitigations.

References

http://www.openwall.com/lists/oss-security/2014/05/21/3
https://bugs.launchpad.net/keystone/+bug/1309228
https://review.openstack.org/#/c/94396/
http://www.openwall.com/lists/oss-security/2014/05/21/3
https://bugs.launchpad.net/keystone/+bug/1309228
https://review.openstack.org/#/c/94396/

Get alerted when CVE-2014-0204 or the next vulnerability affects your stack