Vulnerability in Openstack Grizzly

CVE-2013-4477

The LDAP backend in OpenStack Identity (Keystone) Grizzly and Havana, when removing a role on a tenant for a user who does not have that role, adds the role to the user, which allows local users to gain privileges.

EPSS: 0.004 (36.0th percentile) — read the EPSS interpretation.

Affected products

Openstack Grizzly
Openstack Havana
N/a — versions n/a

Weakness classification (CWE)

CWE-264

References

secalert@redhat.com (mailing-list, x_refsource_MLIST, Patch)
secalert@redhat.com (x_refsource_UBUNTU, vendor-advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)
secalert@redhat.com (x_refsource_CONFIRM, Exploit)