CVE-2013-0282

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

OpenStack Keystone Grizzly before 2013.1, Folsom 2012.1.3 and earlier, and Essex does not properly check if the (1) user, (2) tenant, or (3) domain is enabled when using EC2-style authentication, which allows context-dependent attackers to bypass access restrictions.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2013/02/19/3Third Party Advisory
https://bugs.launchpad.net/keystone/+bug/1121494Third Party Advisory
https://launchpad.net/keystone/+milestone/2012.2.4Third Party Advisory
https://launchpad.net/keystone/grizzly/2013.1Third Party Advisory
https://review.openstack.org/#/c/22319/Vendor Advisory
https://review.openstack.org/#/c/22320/Vendor Advisory
https://review.openstack.org/#/c/22321/Vendor Advisory
http://www.openwall.com/lists/oss-security/2013/02/19/3Third Party Advisory
https://bugs.launchpad.net/keystone/+bug/1121494Third Party Advisory
https://launchpad.net/keystone/+milestone/2012.2.4Third Party Advisory
https://launchpad.net/keystone/grizzly/2013.1Third Party Advisory
https://review.openstack.org/#/c/22319/Vendor Advisory
https://review.openstack.org/#/c/22320/Vendor Advisory
https://review.openstack.org/#/c/22321/Vendor Advisory

Timeline

Published: Apr 12, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-02835.4Katello: Username in Notification page has cross site scripting CVE-2013-02845.0Ruby agent 3.2.0 through 3.5.2 serializes sensitive data when communicating with servers operated by New Relic, which allows remote attacker CVE-2013-02857.5The nori gem 2.0.x before 2.0.2, 1.1.x before 1.1.4, and 1.0.x before 1.0.3 for Ruby does not properly restrict casts of string values, whic CVE-2013-02865.4Pinboard 1.0.6 theme for Wordpress has XSS.CVE-2013-02874.9The Simple Access Provider in System Security Services Daemon (SSSD) 1.9.0 through 1.9.4, when the Active Directory provider is used, does n CVE-2013-02886.8nss-pam-ldapd before 0.7.18 and 0.8.x before 0.8.11 allows context-dependent attackers to cause a denial of service (application crash) and CVE-2013-02894.3Isync 0.4 before 1.0.6, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName f CVE-2013-02904.9The __skb_recv_datagram function in net/core/datagram.c in the Linux kernel before 3.8 does not properly handle the MSG_PEEK flag with zero-CVE-2013-02917.5NextGEN Gallery Plugin for WordPress 1.9.10 and 1.9.11 has a Path Disclosure Vulnerability CVE-2013-02927.2The dbus_g_proxy_manager_filter function in dbus-gproxy in Dbus-glib before 0.100.1 does not properly verify the sender of NameOwnerChanged CVE-2013-02937.8oVirt Node: Lock screen accepts F2 to drop to shell causing privilege escalation CVE-2013-02945.9packet.py in pyrad before 2.1 uses weak random numbers to generate RADIUS authenticators and hash passwords, which makes it easier for remot