CVE-2012-3426: openstack horizon
Vulnerability summary
CVE-2012-3426 is a medium (CVSS 4.9) vulnerability in openstack horizon. EPSS estimates a 2.28% chance of exploitation in the next 30 days, higher than 82.8% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 31-07-2012PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
OpenStack Keystone before 2012.1.1, as used in OpenStack Folsom before Folsom-1 and OpenStack Essex, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by (1) creating new tokens through token chaining, (2) leveraging possession of a token for a disabled user account, or (3) leveraging possession of a token for an account with a changed password.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
2.28%
Chance of exploitation in the next 30 days
Percentile
83%
Versus all other CVEs
30-day change
0.00 pp
From 2.28% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundKeystone
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Debian1 product
- keystone< 2012.1.1-1
PyPI1 product
- keystone< 8.0.0a0 | < a67b24878a6156eab17b9098fa649f0279256f5d | All versions (No fix recorded)
3 vendors · 4 products
References
22 links- github.com/openstack/keystone/commit/d9600434da14976463a0bd03abd8e0309f0db454X Refsource CONFIRMWEBFIX
- github.com/openstack/keystone/commit/29e74e73a6e51cffc0371b32354558391826a4aaX Refsource CONFIRMWEBFIX
- launchpad.net/keystone/essex/2012.1.1/+download/keystone-2012.1.1.tar.gzX Refsource CONFIRMPatchWEBFIX
- github.com/openstack/keystone/commit/ea03d05ed5de0c015042876100d37a6a14bf56deX Refsource CONFIRMExploitPatchWEBEVIDENCEFIX
- github.com/openstack/keystone/commit/628149b3dc6b58b91fd08e6ca8d91c728ccb8626X Refsource CONFIRMExploitPatchWEBEVIDENCEFIX
Show all 22 references
- github.com/openstack/keystone/commit/375838cfceb88cacc312ff6564e64eb18ee6a355X Refsource CONFIRMPatchWEBFIX
- github.com/openstack/keystone/commit/a67b24878a6156eab17b9098fa649f0279256f5dX Refsource CONFIRMWEBFIX
