CVE-2013-4222

MediumCVSS 6.5/10Last modified Jun 16, 2026

Description

OpenStack Identity (Keystone) Folsom, Grizzly 2013.1.3 and earlier, and Havana before havana-3 does not properly revoke user tokens when a tenant is disabled, which allows remote authenticated users to retain access via the token.

Metrics

CVSS 2.0 6.5/10AV:N/AC:L/Au:S/C:P/I:P/A:P

Weakness enumeration

CWE-522

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116489.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-1524.htmlThird Party Advisory
http://www.ubuntu.com/usn/USN-2002-1Third Party Advisory
https://bugs.launchpad.net/ossn/+bug/1179955Issue Tracking, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116489.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-1524.htmlThird Party Advisory
http://www.ubuntu.com/usn/USN-2002-1Third Party Advisory
https://bugs.launchpad.net/ossn/+bug/1179955Issue Tracking, Third Party Advisory

Timeline

Published: Sep 30, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-42235.0The Gentoo Nullmailer package before 1.11-r2 uses world-readable permissions for /etc/nullmailer/remotes, which allows local users to obtain CVE-2013-42258.8The RESTful Web Services (restws) module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to e CVE-2013-42266.5The Authenticated User Page Caching (Authcache) module 7.x-1.x before 7.x-1.5 for Drupal does not properly restrict access to cached pages, CVE-2013-42278.8Cross-site request forgery (CSRF) vulnerability in the persona_xsrf_token function in persona.module in the Mozilla Persona module 7.x-1.x b CVE-2013-42284.3The OG access fields (visibility fields) implementation in Organic Groups (OG) module 7.x-2.x before 7.x-2.3 for Drupal does not properly re CVE-2013-42292.1Cross-site scripting (XSS) vulnerability in the Monster Menus module 7.x-1.x before 7.x-1.12 for Drupal allows remote authenticated users wi CVE-2013-42306.0The mm_webform submodule in the Monster Menus module 6.x-6.x before 6.x-6.61 and 7.x-1.x before 7.x-1.13 for Drupal does not properly restri CVE-2013-42314.3Multiple buffer overflows in libtiff before 4.0.3 allow remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1 CVE-2013-42326.8Use-after-free vulnerability in the t2p_readwrite_pdf_image function in tools/tiff2pdf.c in libtiff 4.0.3 allows remote attackers to cause a CVE-2013-42336.8Integer overflow in the abc_set_parts function in load_abc.cpp in libmodplug 0.8.8.4 and earlier allows remote attackers to cause a denial o CVE-2013-42346.8Multiple heap-based buffer overflows in the (1) abc_MIDI_drum and (2) abc_MIDI_gchord functions in load_abc.cpp in libmodplug 0.8.8.4 and ea CVE-2013-42354.7shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees