Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
3.3

OpenStack Keystone: Local Users Gain Unauthorized Access

CVE-2013-4477 · published 13 years ago
Summary

A bug in OpenStack Keystone's LDAP backend allows local users to gain privileges by manipulating user roles. This can lead to unauthorized access to sensitive information or resources. To fix this issue, update to a version that resolves this vulnerability or apply a workaround if one is available.

What to do
  • Update openstack keystone to version 8.0.0a0.
Affected software
Ecosystem VendorProductAffected versions
pip openstack keystone < 8.0.0a0
Fix: upgrade to 8.0.0a0
– openstack grizzly All versions
cpe:2.3:a:openstack:grizzly:-:*:*:*:*:*:*:*
– openstack havana All versions
cpe:2.3:a:openstack:havana:-:*:*:*:*:*:*:*
Original advisory text
The LDAP backend in OpenStack Identity (Keystone) Grizzly and Havana, when removing a role on a tenant for a user who does not have that role, adds the role to the user, which allows local users to...
The LDAP backend in OpenStack Identity (Keystone) Grizzly and Havana, when removing a role on a tenant for a user who does not have that role, adds the role to the user, which allows local users to gain privileges.
References
Severity
3.3 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-264Permissions, Privileges, and Access Controls
Timeline
Published2 Nov 2013
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-f889-wfwm-6p7m · GHSA
CVE-2013-4477 · NVD
Track software like this
Free during beta