CVE-2014-3520

Severity: medium (CVSS 6.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-10-26 · updated 2026-06-17
Weakness: CWE-863

Description

OpenStack Identity (Keystone) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticated trustees to gain access to an unauthorized project for which the trustor has certain roles via the project ID in a V2 API trust token request.

Affected products

OpenStack Keystone: from 2013.2 before 2013.2.4; from 2014.1 before 2014.1.2 — fixed in 2013.2.4, 2014.1.2

How to fix

Upgrade to a fixed version: OpenStack Keystone 2013.2.4, 2014.1.2. Check the vendor advisory for mitigations.

References

http://lists.openstack.org/pipermail/openstack-announce/2014-July/000248.html
http://secunia.com/advisories/59426
https://bugs.launchpad.net/keystone/+bug/1331912
http://lists.openstack.org/pipermail/openstack-announce/2014-July/000248.html
http://secunia.com/advisories/59426
https://bugs.launchpad.net/keystone/+bug/1331912

Get alerted when CVE-2014-3520 or the next vulnerability affects your stack