CVE-2013-2059: openstack keystone Improper Authentication

EPSS trend

Probability

2.47%

Chance of exploitation in the next 30 days

Percentile

84%

Versus all other CVEs

30-day change

0.00 pp

From 2.47% on 18-09-2026

18-09-202618-10-2026

EPSS score

2.47%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

referenceUnverified
Exploit Reference (bugs.launchpad.net)
Maturity: unknown

References

18 links

lists.opensuse.org/opensuse-updates/2013-06/msg00085.htmlVendor AdvisoryX Refsource SUSEWEB
osvdb.org/93134VDB EntryX Refsource OSVDBWEB
lists.fedoraproject.org/pipermail/package-announce/2013-May/105916.htmlVendor AdvisoryX Refsource FEDORAWEB
secunia.com/advisories/53326Third Party AdvisoryX Refsource SECUNIAVendor AdvisoryAdvisory
www.openwall.com/lists/oss-security/2013/05/09/3Mailing ListX Refsource MLISTWEB
exchange.xforce.ibmcloud.com/vulnerabilities/84135VDB EntryX Refsource XFWEB
lists.fedoraproject.org/pipermail/package-announce/2013-May/106220.htmlVendor AdvisoryX Refsource FEDORAWEB
bugs.launchpad.net/keystone/+bug/1166670X Refsource CONFIRMExploitWEBEVIDENCE
secunia.com/advisories/53339Third Party AdvisoryX Refsource SECUNIAVendor AdvisoryAdvisory
www.securityfocus.com/bid/59787VDB EntryX Refsource BIDWEB

Show all 18 references

Related vulnerabilities

CVE-2018-20170ubuntukeystone+21.12%7y ago17-12-2018 06:00OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones for a POST /v3/auth/tokens request. NOTE: the vendor's position is that this is a hardening opportunity, and not necessarily an issue that should have an OpenStack Security Advisory CVE-2018-14432debiankeystone+1861.60%8y ago31-07-2018 14:00In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated "GET /v3/OS-FEDERATION/projects" request may bypass intended access restrictions on listing projects. An authenticated user may discover projects they have no authority to access, leaking all projects in the deployment and their attributes. Only Keystone with the /v3/OS-FEDERATION endpoint enabled via policy.json is affected.CVE-2013-2014debiankeystone+33.27%12y ago02-06-2014 15:00OpenStack Identity (Keystone) before 2013.1 allows remote attackers to cause a denial of service (memory consumption and crash) via multiple long requests.CVE-2013-2006debiankeystone+50.61%13y ago21-05-2013 18:00OpenStack Identity (Keystone) Grizzly 2013.1.1, when DEBUG mode logging is enabled, logs the (1) admin_token and (2) LDAP password in plaintext, which allows local users to obtain sensitive by reading the log file.CVE-2013-2255debiankeystone+80.97%6y ago01-11-2019 18:38HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates.CVE-2013-2157debiankeystone+43.13%13y ago20-08-2013 22:00OpenStack Keystone Folsom, Grizzly before 2013.1.3, and Havana, when using LDAP with Anonymous binding, allows remote attackers to bypass authentication via an empty password.

All vulnerabilities inkeystone

CVE-2013-2059: openstack keystone Improper Authentication

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References