CVE-2013-4222
OpenStack Identity (Keystone) Folsom, Grizzly 2013.1.3 and earlier, and Havana before havana-3...
OpenStack Identity (Keystone) Folsom, Grizzly 2013.1.3 and earlier, and Havana before havana-3 does not properly revoke user tokens when a tenant is disabled, which allows remote authenticated users to retain access via the token.
Exploit likelihood
What each source reports
NVD Score used
OpenStack Identity (Keystone) Folsom, Grizzly 2013.1.3 and earlier, and Havana before havana-3 does not properly revoke user tokens when a tenant is disabled, which allows remote authenticated users to retain access via the token.
- Record
CVE-2013-4222- CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-522
- Updated
- 2026-11-02
CVE List No score
OpenStack Identity (Keystone) Folsom, Grizzly 2013.1.3 and earlier, and Havana before havana-3 does not properly revoke user tokens when a tenant is disabled, which allows remote authenticated users to retain access via the token.
- Record
CVE-2013-4222- Updated
- 2026-11-02
EUVDEUVD-2013-4126 No score
OpenStack Identity (Keystone) Folsom, Grizzly 2013.1.3 and earlier, and Havana before havana-3 does not properly revoke user tokens when a tenant is disabled, which allows remote authenticated users to retain access via the token.
- Record
EUVD-2013-4126- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g99j-vfcp-3vmf No score
OpenStack Identity (Keystone) Folsom, Grizzly 2013.1.3 and earlier, and Havana before havana-3...
OpenStack Identity (Keystone) Folsom, Grizzly 2013.1.3 and earlier, and Havana before havana-3 does not properly revoke user tokens when a tenant is disabled, which allows remote authenticated users to retain access via the token.
- Record
GHSA-g99j-vfcp-3vmf- Weakness
- CWE-522
- Updated
- 2026-11-02
OSV No score
OpenStack Identity (Keystone) Folsom, Grizzly 2013.1.3 and earlier, and Havana before havana-3 does not properly revoke user tokens when a tenant is disabled, which allows remote authenticated users to retain access via the token.
- Record
CVE-2013-4222- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-4222 No score
OpenStack Identity (Keystone) Folsom, Grizzly 2013.1.3 and earlier, and Havana before havana-3 does not properly revoke user tokens when a tenant is disabled, which allows remote authenticated users to retain access via the token.
- Record
DEBIAN-CVE-2013-4222- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
keystoneDebian:12 |
before 2013.1.3-1 | 2013.1.3-1 |
keystoneDebian:13 |
before 2013.1.3-1 | 2013.1.3-1 |
keystoneDebian:14 |
before 2013.1.3-1 | 2013.1.3-1 |
openstack-keystoneRed Hat:openstack:3::el6 |
before 0:2013.1.4-1.el6ost | 0:2013.1.4-1.el6ost |
openstack-keystone-docRed Hat:openstack:3::el6 |
before 0:2013.1.4-1.el6ost | 0:2013.1.4-1.el6ost |
python-keystoneRed Hat:openstack:3::el6 |
before 0:2013.1.4-1.el6ost | 0:2013.1.4-1.el6ost |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-4222 is a medium vulnerability (CVSS 6.5) in Openstack Keystone, published September 30, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.89%, the 79th percentile. Fixed in keystone 2013.1.3-1.
References
rhn.redhat.com/errata/RHSA-2013-1524.html
ubuntu.com/usn/USN-2002-1
lists.fedoraproject.org/pipermail/package-announce/2013-September/116489.html
bugs.launchpad.net/ossn/+bug/1179955
nvd.nist.gov/vuln/detail/CVE-2013-4222
access.redhat.com/errata/RHSA-2013:1524
Show 8 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=995598
github.com/advisories/GHSA-g99j-vfcp-3vmf
security-tracker.debian.org/tracker/CVE-2013-4222
security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1524.json
cve.org/CVERecord?id=CVE-2013-4222