CVE-2013-2157

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

OpenStack Keystone Folsom, Grizzly before 2013.1.3, and Havana, when using LDAP with Anonymous binding, allows remote attackers to bypass authentication via an empty password.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://rhn.redhat.com/errata/RHSA-2013-0994.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-1083.htmlThird Party Advisory
http://www.openwall.com/lists/oss-security/2013/06/13/3Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/60545Third Party Advisory, VDB Entry
http://rhn.redhat.com/errata/RHSA-2013-0994.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-1083.htmlThird Party Advisory
http://www.openwall.com/lists/oss-security/2013/06/13/3Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/60545Third Party Advisory, VDB Entry

Timeline

Published: Aug 20, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-21586.8Cross-site request forgery (CSRF) vulnerability in the Services module 6.x-3.x and 7.x-3.x before 7.x-3.4 for Drupal allows remote attackers CVE-2013-21599.8Monkey HTTP Daemon: broken user name authentication CVE-2013-21605.0The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a de CVE-2013-21617.5XML injection vulnerability in account/utils.py in OpenStack Swift Folsom, Grizzly, and Havana allows attackers to trigger invalid or spoofe CVE-2013-21621.9Race condition in the post-installation script (mysql-server-5.5.postinst) for MySQL Server 5.5 for Debian GNU/Linux and Ubuntu Linux create CVE-2013-21635.0Monkey HTTP Daemon (monkeyd) before 1.2.2 allows remote attackers to cause a denial of service (infinite loop) via an offset equal to the fi CVE-2013-21642.1The mmc_ioctl_cdrom_read_data function in drivers/cdrom/cdrom.c in the Linux kernel through 3.10 allows local users to obtain sensitive info CVE-2013-21657.5ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web CVE-2013-21669.8python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache encryption bypass CVE-2013-21679.8python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache signing bypass CVE-2013-21681.9The _dbus_printf_string_upper_bound function in dbus/dbus-sysdeps-unix.c in D-Bus (aka DBus) 1.4.x before 1.4.26, 1.6.x before 1.6.12, and 1 CVE-2013-21716.9The vm_map_lookup function in sys/vm/vm_map.c in the mmap implementation in the kernel in FreeBSD 9.0 through 9.1-RELEASE-p4 does not proper