{"api_version":"1","generated_at":"2026-07-23T10:23:34+00:00","cve":"CVE-2013-4294","urls":{"html":"https://cve.report/CVE-2013-4294","api":"https://cve.report/api/cve/CVE-2013-4294.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2013-4294","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2013-4294"},"summary":{"title":"CVE-2013-4294","description":"The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012.2.x and Grizzly before 2013.1.4 do not properly compare the PKI token revocation list with PKI tokens, which allow remote attackers to bypass intended access restrictions via a revoked PKI token.","state":"PUBLISHED","assigner":"redhat","published_at":"2013-09-23 20:55:07","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-264","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"5","severity":"","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2013-1285.html","name":"http://rhn.redhat.com/errata/RHSA-2013-1285.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://osvdb.org/97237","name":"http://osvdb.org/97237","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.ubuntu.com/usn/USN-2002-1","name":"http://www.ubuntu.com/usn/USN-2002-1","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"USN-2002-1: Keystone vulnerabilities | Ubuntu","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://seclists.org/oss-sec/2013/q3/586","name":"http://seclists.org/oss-sec/2013/q3/586","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"oss-sec: [OSSA 2013-025] Token revocation failure using Keystone memcache/KVS backends (CVE-2013-4294)","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/54706","name":"http://secunia.com/advisories/54706","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"About Secunia Research | Flexera","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://bugs.launchpad.net/keystone/+bug/1202952","name":"https://bugs.launchpad.net/keystone/+bug/1202952","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Bug #1202952 “[OSSA 2013-025] PKI tokens are never revoked using...” : Bugs : OpenStack Identity (keystone)","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://access.redhat.com/errata/RHSA-2013:1285","name":"MISC:https://access.redhat.com/errata/RHSA-2013:1285","refsource":"MITRE","tags":[],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://access.redhat.com/security/cve/CVE-2013-4294","name":"MISC:https://access.redhat.com/security/cve/CVE-2013-4294","refsource":"MITRE","tags":[],"title":"CVE-2013-4294 - Red Hat Customer Portal","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1004452","name":"MISC:https://bugzilla.redhat.com/show_bug.cgi?id=1004452","refsource":"MITRE","tags":[],"title":"1004452 – (CVE-2013-4294) CVE-2013-4294 OpenStack: Keystone Token revocation failure using Keystone memcache/KVS backends","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4294","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4294","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2013","cve_id":"4294","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"openstack","cpe5":"keystone","cpe6":"2012.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4294","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"openstack","cpe5":"keystone","cpe6":"2012.2.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4294","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"openstack","cpe5":"keystone","cpe6":"2012.2.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4294","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"openstack","cpe5":"keystone","cpe6":"2012.2.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4294","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"openstack","cpe5":"keystone","cpe6":"2012.2.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4294","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"openstack","cpe5":"keystone","cpe6":"2013.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4294","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"openstack","cpe5":"keystone","cpe6":"2013.1.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4294","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"openstack","cpe5":"keystone","cpe6":"2013.1.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"4294","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"openstack","cpe5":"keystone","cpe6":"2013.1.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T16:38:01.910Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"97237","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/97237"},{"name":"USN-2002-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred"],"url":"http://www.ubuntu.com/usn/USN-2002-1"},{"name":"54706","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/54706"},{"name":"[oss-security] 20130911  [OSSA 2013-025] Token revocation failure using Keystone memcache/KVS backends (CVE-2013-4294)","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://seclists.org/oss-sec/2013/q3/586"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://bugs.launchpad.net/keystone/+bug/1202952"},{"name":"RHSA-2013:1285","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://rhn.redhat.com/errata/RHSA-2013-1285.html"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2013-09-11T00:00:00.000Z","descriptions":[{"lang":"en","value":"The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012.2.x and Grizzly before 2013.1.4 do not properly compare the PKI token revocation list with PKI tokens, which allow remote attackers to bypass intended access restrictions via a revoked PKI token."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2013-10-02T09:00:00.000Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat"},"references":[{"name":"97237","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/97237"},{"name":"USN-2002-1","tags":["vendor-advisory","x_refsource_UBUNTU"],"url":"http://www.ubuntu.com/usn/USN-2002-1"},{"name":"54706","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/54706"},{"name":"[oss-security] 20130911  [OSSA 2013-025] Token revocation failure using Keystone memcache/KVS backends (CVE-2013-4294)","tags":["mailing-list","x_refsource_MLIST"],"url":"http://seclists.org/oss-sec/2013/q3/586"},{"tags":["x_refsource_CONFIRM"],"url":"https://bugs.launchpad.net/keystone/+bug/1202952"},{"name":"RHSA-2013:1285","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://rhn.redhat.com/errata/RHSA-2013-1285.html"}]}},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2013-4294","datePublished":"2013-09-23T20:00:00.000Z","dateReserved":"2013-06-12T00:00:00.000Z","dateUpdated":"2024-08-06T16:38:01.910Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2013-09-23 20:55:07","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-264","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:openstack:keystone:2012.2:*:*:*:*:*:*:*","matchCriteriaId":"22E8C9F6-6DEE-4DD1-9B3E-5879E51464B9"},{"vulnerable":true,"criteria":"cpe:2.3:a:openstack:keystone:2012.2.1:*:*:*:*:*:*:*","matchCriteriaId":"4C26C7AF-F31B-48B4-8FA0-FBA24E86D641"},{"vulnerable":true,"criteria":"cpe:2.3:a:openstack:keystone:2012.2.2:*:*:*:*:*:*:*","matchCriteriaId":"792412B1-891F-404E-BC7F-1FA1DF4A623B"},{"vulnerable":true,"criteria":"cpe:2.3:a:openstack:keystone:2012.2.3:*:*:*:*:*:*:*","matchCriteriaId":"4481B437-5602-4EC9-BAD2-7EF065448E69"},{"vulnerable":true,"criteria":"cpe:2.3:a:openstack:keystone:2012.2.4:*:*:*:*:*:*:*","matchCriteriaId":"3A5845BE-3B3F-4015-872A-C4D2771736F0"},{"vulnerable":true,"criteria":"cpe:2.3:a:openstack:keystone:2013.1:*:*:*:*:*:*:*","matchCriteriaId":"70697FA3-5C64-4632-B0F5-7DF12B4B7067"},{"vulnerable":true,"criteria":"cpe:2.3:a:openstack:keystone:2013.1.1:*:*:*:*:*:*:*","matchCriteriaId":"F72F13BC-BE73-4DCD-8C7F-7D803CB047FF"},{"vulnerable":true,"criteria":"cpe:2.3:a:openstack:keystone:2013.1.2:*:*:*:*:*:*:*","matchCriteriaId":"BFF04D50-069F-493B-8667-C55EA6413AD3"},{"vulnerable":true,"criteria":"cpe:2.3:a:openstack:keystone:2013.1.3:*:*:*:*:*:*:*","matchCriteriaId":"0911BBF3-6111-4ED8-B269-EB4383C5DC05"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2013","CveId":"4294","Ordinal":"1","Title":"CVE-2013-4294","CVE":"CVE-2013-4294","Year":"2013"},"notes":[{"CveYear":"2013","CveId":"4294","Ordinal":"1","NoteData":"The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012.2.x and Grizzly before 2013.1.4 do not properly compare the PKI token revocation list with PKI tokens, which allow remote attackers to bypass intended access restrictions via a revoked PKI token.","Type":"Description","Title":"CVE-2013-4294"},{"CveYear":"2013","CveId":"4294","Ordinal":"2","NoteData":"2013-09-23","Type":"Other","Title":"Published"},{"CveYear":"2013","CveId":"4294","Ordinal":"3","NoteData":"2013-10-02","Type":"Other","Title":"Modified"}]}}}