CVE-2012-4413

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

1.88%

Published

Sep 18, 2012

Modified

Apr 28, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

OpenStack Keystone 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles.

Weaknesses (CWE)

CWE-264

Affected Products (1)

openstack · keystonevulnerable

References (14)

http://osvdb.org/85484

http://secunia.com/advisories/50531

Vendor Advisory

http://secunia.com/advisories/50590

Vendor Advisory

http://www.openwall.com/lists/oss-security/2012/09/12/7

http://www.securityfocus.com/bid/55524

http://www.ubuntu.com/usn/USN-1564-1

https://exchange.xforce.ibmcloud.com/vulnerabilities/78478

http://osvdb.org/85484

http://secunia.com/advisories/50531

Vendor Advisory

http://secunia.com/advisories/50590

Vendor Advisory

http://www.openwall.com/lists/oss-security/2012/09/12/7

http://www.securityfocus.com/bid/55524

http://www.ubuntu.com/usn/USN-1564-1

https://exchange.xforce.ibmcloud.com/vulnerabilities/78478

KEV Catalog EPSS Scores Vendors All CVEs