Every CVE Search/ Get API key

CVE-2014-3520

OpenStack Identity (Keystone) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2...

6.5 MediumFix available

OpenStack Identity (Keystone) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticated trustees to gain access to an unauthorized project for which the trustor has certain roles via the project ID in a V2 API trust token request.

Exploit likelihood

1.91%Up 0.8 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 6.5

OpenStack Identity (Keystone) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticated trustees to gain access to an unauthorized project for which the trustor has certain roles via the project ID in a V2 API trust token request.

Record
CVE-2014-3520
CVSS 2.0
6.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:P
Weakness
CWE-863
Updated
2026-11-02
CVE List No score

OpenStack Identity (Keystone) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticated trustees to gain access to an unauthorized project for which the trustor has certain roles via the project ID in a V2 API trust token request.

Record
CVE-2014-3520
Updated
2026-11-02
EUVDEUVD-2014-3519 No score

OpenStack Identity (Keystone) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticated trustees to gain access to an unauthorized project for which the trustor has certain roles via the project ID in a V2 API trust token request.

Record
EUVD-2014-3519
Updated
2026-11-03
GitHub AdvisoriesGHSA-mv96-4gm9-mjhw No score

OpenStack Identity (Keystone) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2...

OpenStack Identity (Keystone) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticated trustees to gain access to an unauthorized project for which the trustor has certain roles via the project ID in a V2 API trust token request.

Record
GHSA-mv96-4gm9-mjhw
Weakness
CWE-863
Updated
2026-11-02
OSV No score

OpenStack Identity (Keystone) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticated trustees to gain access to an unauthorized project for which the trustor has certain roles via the project ID in a V2 API trust token request.

Record
CVE-2014-3520
Updated
2026-11-02
OSVDEBIAN-CVE-2014-3520 No score

OpenStack Identity (Keystone) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticated trustees to gain access to an unauthorized project for which the trustor has certain roles via the project ID in a V2 API trust token request.

Record
DEBIAN-CVE-2014-3520
Updated
2026-11-02
OSVUBUNTU-CVE-2014-3520 No score

OpenStack Identity (Keystone) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticated trustees to gain access to an unauthorized project for which the trustor has certain roles via the project ID in a V2 API trust token request.

Record
UBUNTU-CVE-2014-3520
Updated
2026-11-02
OSVUSN-2324-1 No score

keystone vulnerabilities

Steven Hardy discovered that OpenStack Keystone did not properly handle chained delegation. A remove authenticated attacker could use this to gain privileges by creating a new token with additional roles. (CVE-2014-3476)

Jamie Lennox discovered that OpenStack Keystone did not properly validate the project id. A remote authenticated attacker may be able to use this to access other projects. (CVE-2014-3520)

Brant Knudson and Lance Bragstad discovered that OpenStack Keystone would not always revoke tokens correctly. If Keystone were configured to use revocation events, a remote authenticated attacker could continue to have access to resources. (CVE-2014-5251, CVE-2014-5252, CVE-2014-5253)

Record
USN-2324-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
keystone
Debian:12
 before 2014.1.1-3
2014.1.1-3
keystone
Debian:13
 before 2014.1.1-3
2014.1.1-3
keystone
Debian:14
 before 2014.1.1-3
2014.1.1-3
openstack-keystone
Red Hat:openstack:3::el6
From an advisory covering 2 CVEs
 before 0:2013.1.5-3.el6ost
0:2013.1.5-3.el6ost
openstack-keystone-doc
Red Hat:openstack:3::el6
From an advisory covering 2 CVEs
 before 0:2013.1.5-3.el6ost
0:2013.1.5-3.el6ost
python-keystone
Red Hat:openstack:3::el6
From an advisory covering 2 CVEs
 before 0:2013.1.5-3.el6ost
0:2013.1.5-3.el6ost
openstack-keystone
Red Hat:openstack:4::el6
From an advisory covering 2 CVEs
 before 0:2013.2.3-7.el6ost
0:2013.2.3-7.el6ost
openstack-keystone-doc
Red Hat:openstack:4::el6
From an advisory covering 2 CVEs
 before 0:2013.2.3-7.el6ost
0:2013.2.3-7.el6ost
python-keystone
Red Hat:openstack:4::el6
From an advisory covering 2 CVEs
 before 0:2013.2.3-7.el6ost
0:2013.2.3-7.el6ost
keystone
Ubuntu:14.04:LTS
 before 1:2014.1.2.1-0ubuntu1, plus listed versions
1:2013.2~rc4-0ubuntu11:2013.2-0ubuntu11:2013.2-0ubuntu1.11:2014.1~b1-0ubuntu11:2014.1~b2-0ubuntu1
Show 6 moreShow less
1:2014.1~b3-0ubuntu21:2014.1~b3-0ubuntu31:2014.1~rc1-0ubuntu11:2014.1~rc2-0ubuntu11:2014.1-0ubuntu11:2014.1.1-0ubuntu1
1:2014.1.2.1-0ubuntu1
keystone
Ubuntu:14.04:LTS
From an advisory covering 5 CVEs
 before 1:2014.1.2.1-0ubuntu1.1, plus listed versions
1:2013.2~rc4-0ubuntu11:2013.2-0ubuntu11:2013.2-0ubuntu1.11:2014.1~b1-0ubuntu11:2014.1~b2-0ubuntu1
Show 7 moreShow less
1:2014.1~b3-0ubuntu21:2014.1~b3-0ubuntu31:2014.1~rc1-0ubuntu11:2014.1~rc2-0ubuntu11:2014.1-0ubuntu11:2014.1.1-0ubuntu11:2014.1.2.1-0ubuntu1
1:2014.1.2.1-0ubuntu1.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-3520 is a medium vulnerability (CVSS 6.5) in Openstack Keystone, published July 2, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.91%, the 79th percentile. Fixed in keystone 2014.1.1-3.

References

Show 17 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open