CVE-2013-2157
OpenStack Keystone Folsom, Grizzly before 2013.1.3, and Havana, when using LDAP with Anonymous...
OpenStack Keystone Folsom, Grizzly before 2013.1.3, and Havana, when using LDAP with Anonymous binding, allows remote attackers to bypass authentication via an empty password.
Exploit likelihood
What each source reports
NVD Score used
OpenStack Keystone Folsom, Grizzly before 2013.1.3, and Havana, when using LDAP with Anonymous binding, allows remote attackers to bypass authentication via an empty password.
- Record
CVE-2013-2157- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE ListNo score
OpenStack Keystone Folsom, Grizzly before 2013.1.3, and Havana, when using LDAP with Anonymous binding, allows remote attackers to bypass authentication via an empty password.
- Record
CVE-2013-2157- Updated
- 2026-11-02
EUVDEUVD-2013-2122No score
OpenStack Keystone Folsom, Grizzly before 2013.1.3, and Havana, when using LDAP with Anonymous binding, allows remote attackers to bypass authentication via an empty password.
- Record
EUVD-2013-2122- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w396-2gg4-mxgvNo score
OpenStack Keystone Folsom, Grizzly before 2013.1.3, and Havana, when using LDAP with Anonymous...
OpenStack Keystone Folsom, Grizzly before 2013.1.3, and Havana, when using LDAP with Anonymous binding, allows remote attackers to bypass authentication via an empty password.
- Record
GHSA-w396-2gg4-mxgv- Weakness
- CWE-287
- Updated
- 2026-11-02
OSVNo score
OpenStack Keystone Folsom, Grizzly before 2013.1.3, and Havana, when using LDAP with Anonymous binding, allows remote attackers to bypass authentication via an empty password.
- Record
CVE-2013-2157- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-2157No score
OpenStack Keystone Folsom, Grizzly before 2013.1.3, and Havana, when using LDAP with Anonymous binding, allows remote attackers to bypass authentication via an empty password.
- Record
DEBIAN-CVE-2013-2157- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
keystoneDebian:12 | before 2013.1.2-1 | 2013.1.2-1 |
keystoneDebian:13 | before 2013.1.2-1 | 2013.1.2-1 |
keystoneDebian:14 | before 2013.1.2-1 | 2013.1.2-1 |
openstack-keystoneRed Hat:openstack:3::el6 | before 0:2013.1.2-2.el6ost | 0:2013.1.2-2.el6ost |
openstack-keystone-docRed Hat:openstack:3::el6 | before 0:2013.1.2-2.el6ost | 0:2013.1.2-2.el6ost |
python-keystoneRed Hat:openstack:3::el6 | before 0:2013.1.2-2.el6ost | 0:2013.1.2-2.el6ost |
openstack-keystoneRed Hat:openstack:2::el6 | before 0:2012.2.4-3.el6ost | 0:2012.2.4-3.el6ost |
openstack-keystone-docRed Hat:openstack:2::el6 | before 0:2012.2.4-3.el6ost | 0:2012.2.4-3.el6ost |
python-keystoneRed Hat:openstack:2::el6 | before 0:2012.2.4-3.el6ost | 0:2012.2.4-3.el6ost |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-2157 is a medium vulnerability (CVSS 4.3) in Openstack Keystone, published August 20, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.13%, the 88th percentile. Fixed in keystone 2013.1.2-1.
References
openwall.com/lists/oss-security/2013/06/13/3
rhn.redhat.com/errata/RHSA-2013-1083.html
securityfocus.com/bid/60545
nvd.nist.gov/vuln/detail/CVE-2013-2157
github.com/advisories/GHSA-w396-2gg4-mxgv
Show 9 moreShow less
security-tracker.debian.org/tracker/CVE-2013-2157
access.redhat.com/errata/RHSA-2013:0994
bugzilla.redhat.com/show_bug.cgi?id=971884
security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0994.json
cve.org/CVERecord?id=CVE-2013-2157