Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
openstack keystone vulnerabilities and exploits
(subscribe to this query)
8.8
CVSSv3
CVE-2019-19687
OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other user...
Openstack Keystone 15.0.0
Openstack Keystone 16.0.0
NA
CVE-2012-3426
OpenStack Keystone prior to 2012.1.1, as used in OpenStack Folsom before Folsom-1 and OpenStack Essex, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by (1) creating new tokens through token chai...
Openstack Essex
Openstack Keystone 2012.1.1
Openstack Keystone 2012.1
Openstack Horizon Folsom-1
8.8
CVSSv3
CVE-2020-12689
An issue exists in OpenStack Keystone prior to 15.0.1, and 16.0.0. Any user authenticated within a limited scope (trust/oauth/application credential) can create an EC2 credential with an escalated permission, such as obtaining admin while the user is on a limited viewer role. Thi...
Openstack Keystone 16.0.0
Openstack Keystone
Canonical Ubuntu Linux 18.04
8.8
CVSSv3
CVE-2020-12691
An issue exists in OpenStack Keystone prior to 15.0.1, and 16.0.0. Any authenticated user can create an EC2 credential for themselves for a project that they have a specified role on, and then perform an update to the credential user and project, allowing them to masquerade as an...
Openstack Keystone 16.0.0
Openstack Keystone
Canonical Ubuntu Linux 18.04
5.4
CVSSv3
CVE-2020-12692
An issue exists in OpenStack Keystone prior to 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can sniff the Authorization header, and then use it to reissue an OpenStack token an unlimited number of times.
Openstack Keystone 16.0.0
Openstack Keystone
Canonical Ubuntu Linux 18.04
NA
CVE-2013-1665
The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote malicious users to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, ...
Openstack Folsom -
Openstack Keystone Essex -
7.5
CVSSv3
CVE-2021-38155
OpenStack Keystone 10.x up to and including 16.x prior to 16.0.2, 17.x prior to 17.0.1, 18.x prior to 18.0.1, and 19.x prior to 19.0.1 allows information disclosure during account locking (related to PCI DSS features). By guessing the name of an account and failing to authenticat...
Openstack Keystone
NA
CVE-2014-0204
OpenStack Identity (Keystone) prior to 2014.1.1 does not properly handle when a role is assigned to a group that has the same ID as a user, which allows remote authenticated users to gain privileges that are assigned to a group with the same ID.
Openstack Keystone
NA
CVE-2013-2157
OpenStack Keystone Folsom, Grizzly prior to 2013.1.3, and Havana, when using LDAP with Anonymous binding, allows remote malicious users to bypass authentication via an empty password.
Openstack Keystone
5.3
CVSSv3
CVE-2018-20170
OpenStack Keystone up to and including 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones for a POST /v3/auth/tokens request. NOTE: the vendor's position is that this is a hardening opportunity, and not necessaril...
Openstack Keystone
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-33228
CVE-2024-20361
log injection
bypass
CVE-2024-4985
CVE-2024-35223
CVE-2024-29849
CVE-2024-31893
IMAP
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
NEXT »