CVE-2013-0247 : OpenStack Keystone Essex 2012.1.3 and earlier, Folsom 2012.2.3 and earlier, and

OpenStack Keystone Essex 2012.1.3 and earlier, Folsom 2012.2.3 and earlier, and Grizzly grizzly-2 and earlier allows remote attackers to cause a denial of service (disk consumption) via many invalid token requests that trigger excessive generation of log entries.

Published 2013-02-24 19:55:01

Updated 2025-04-11 00:51:22

Source Red Hat, Inc.

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2013-0247

Canonical » Ubuntu Linux » Version: 12.10
cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 12.04 LTS Edition
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
Matching versions
Openstack » Keystone
Versions from including (>=) 2013.1 and up to, including, (<=) 2013.1.2
cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:*
Matching versions
Openstack » Keystone
Versions from including (>=) 2012.1 and up to, including, (<=) 2012.1.3
cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:*
Matching versions
Openstack » Keystone
Versions from including (>=) 2012.2 and up to, including, (<=) 2012.2.3
cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2013-0247

EPSS FAQ

2.96%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 85 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2013-0247

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:N/A:P	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial

CWE ids for CVE-2013-0247

CWE-399

Assigned by: nvd@nist.gov (Primary)

References for CVE-2013-0247

http://www.securityfocus.com/bid/57747

OpenStack Keystone CVE-2013-0247 Denial of Service Vulnerability
Third Party Advisory;VDB Entry
http://rhn.redhat.com/errata/RHSA-2013-0253.html

RHSA-2013:0253 - Security Advisory - Red Hat Customer Portal
Third Party Advisory
http://www.ubuntu.com/usn/USN-1715-1

USN-1715-1: OpenStack Keystone vulnerability | Ubuntu security notices
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=906171

906171 – (CVE-2013-0247) CVE-2013-0247 OpenStack Keystone: denial of service through invalid token requests
Patch;Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098906.html

[SECURITY] Fedora 18 Update: openstack-keystone-2012.2.3-2.fc18
Third Party Advisory
https://bugs.launchpad.net/keystone/+bug/1098307

Bug #1098307 “[OSSA 2013-003] unauthenticated POST to /tokens ca...” : Bugs : OpenStack Identity (keystone)
Third Party Advisory

Jump to

Vulnerability Details : CVE-2013-0247

Products affected by CVE-2013-0247

Exploit prediction scoring system (EPSS) score for CVE-2013-0247

CVSS scores for CVE-2013-0247

CWE ids for CVE-2013-0247

References for CVE-2013-0247