{"id":"CVE-2012-4456","published":"2012-10-09T15:00:00Z","modified":"2024-08-06T20:35:09Z","title":"The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2…","vendor":null,"product":null,"tier":"tail","description":{"text":"The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.03998,"percentile":0.90528,"provenance":"source"},"cwes":[],"references":[{"url":"http://www.openwall.com/lists/oss-security/2012/09/28/5","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://secunia.com/advisories/50665","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"https://lists.launchpad.net/openstack/msg17034.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://github.com/openstack/keystone/commit/24df3adb3f50cbb5ada411bc67aba8a781e6a431","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/openstack/keystone/commit/14b136aed9d988f5a8f3e699bd4577c9b874d6c1","tags":["x_refsource_CONFIRM"]},{"url":"https://bugs.launchpad.net/keystone/+bug/1006822","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/bid/55716","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://bugs.launchpad.net/keystone/+bug/1006815","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/openstack/keystone/commit/868054992faa45d6f42d822bf1588cb88d7c9ccb","tags":["x_refsource_CONFIRM"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/78944","tags":["vdb-entry","x_refsource_XF"]},{"url":"https://github.com/openstack/keystone/commit/1d146f5c32e58a73a677d308370f147a3271c2cb","tags":["x_refsource_CONFIRM"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=861179","tags":["x_refsource_MISC"]}],"priority":{"score":18.1,"factors":[{"name":"EPSS percentile","points":18.11}]},"affected":[{"ecosystem":"PyPI","package":"keystone","vulnerableRanges":[">=2012.1, <2012.1.2"],"patched":["2012.1.2"],"from":["GHSA-mf98-r2gf-2x3w","PYSEC-2026-832"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-4547","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-openstack-keystone-cve-2012-3426","parents":[{"from":"CVE-2012-3542","to":"CVE-2012-4456","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:keystone","fromFixed":"2012.1","toFixed":"2012.1.2","daysApart":34},{"kind":"same-code","provenance":"machine","files":["keystone/identity/core.py"],"commits":["https://github.com/openstack/keystone/commit/c13d0ba606f7b2bdc609a7f388334e5efec3f3aa","https://github.com/openstack/keystone/commit/5438d3b5a219d7c8fa67e66e538d325a61617155","https://github.com/openstack/keystone/commit/14b136aed9d988f5a8f3e699bd4577c9b874d6c1","https://github.com/openstack/keystone/commit/24df3adb3f50cbb5ada411bc67aba8a781e6a431"],"basis":"rarely changed file"},{"kind":"similar","provenance":"machine","score":0.52,"basis":"same package + description similarity"}]},{"from":"CVE-2012-3426","to":"CVE-2012-4456","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["keystone/identity/core.py"],"commits":["https://github.com/openstack/keystone/commit/29e74e73a6e51cffc0371b32354558391826a4aa","https://github.com/openstack/keystone/commit/d9600434da14976463a0bd03abd8e0309f0db454","https://github.com/openstack/keystone/commit/14b136aed9d988f5a8f3e699bd4577c9b874d6c1","https://github.com/openstack/keystone/commit/24df3adb3f50cbb5ada411bc67aba8a781e6a431"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2026-43001","published":"2026-05-01","fixed":"29.0.2","kev":false},{"cve":"CVE-2026-44394","published":"2026-05-28","fixed":"29.0.2","kev":false},{"cve":"CVE-2012-3542","published":"2012-09-05","fixed":"2012.1","kev":false},{"cve":"CVE-2012-4456","published":"2012-10-09","fixed":"2012.1.2","kev":false},{"cve":"CVE-2012-4413","published":"2012-09-18","fixed":"2012.1.3","kev":false},{"cve":"CVE-2013-1865","published":"2013-03-22","fixed":"2012.2.4","kev":false},{"cve":"CVE-2013-4294","published":"2013-09-23","fixed":"2013.1.4","kev":false}],"package":"PyPI:keystone"}}