CVE-2013-4477
OpenStack Identity Keystone Privilege Escalation vulnerability
CVE-2013-4477 is a low vulnerability (CVSS 3.3) in Openstack Grizzly, published November 2, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.45%, the 39th percentile. Fixed in keystone 8.0.0a0.
- Severity
- 3.3 LowCVSS 2.0, NVD
- Exploit chance
- 0.45%EPSS, 39th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
8.0.0a0keystone +6 more
Description
The LDAP backend in OpenStack Identity (Keystone) Grizzly and Havana, when removing a role on a tenant for a user who does not have that role, adds the role to the user, which allows local users to gain privileges.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
keystonePyPI | before 8.0.0a0 | 8.0.0a0 |
keystoneDebian:12 | before 2013.2-2 | 2013.2-2 |
keystoneDebian:13 | before 2013.2-2 | 2013.2-2 |
keystoneDebian:14 | before 2013.2-2 | 2013.2-2 |
openstack-keystoneRed Hat:openstack:3::el6 | before 0:2013.1.4-2.el6ost | 0:2013.1.4-2.el6ost |
openstack-keystone-docRed Hat:openstack:3::el6 | before 0:2013.1.4-2.el6ost | 0:2013.1.4-2.el6ost |
python-keystoneRed Hat:openstack:3::el6 | before 0:2013.1.4-2.el6ost | 0:2013.1.4-2.el6ost |
What each source reports
NVD Score used
The LDAP backend in OpenStack Identity (Keystone) Grizzly and Havana, when removing a role on a tenant for a user who does not have that role, adds the role to the user, which allows local users to gain privileges.
- Record
CVE-2013-4477- CVSS 2.0
- 3.3 Low
AV:L/AC:M/Au:N/C:P/I:P/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE ListNo score
The LDAP backend in OpenStack Identity (Keystone) Grizzly and Havana, when removing a role on a tenant for a user who does not have that role, adds the role to the user, which allows local users to gain privileges.
- Record
CVE-2013-4477- Updated
- 2026-11-02
EUVDEUVD-2022-3724No score
The LDAP backend in OpenStack Identity (Keystone) Grizzly and Havana, when removing a role on a tenant for a user who does not have that role, adds the role to the user, which allows local users to gain privileges.
- Record
EUVD-2022-3724- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f889-wfwm-6p7mNo score
OpenStack Identity Keystone Privilege Escalation vulnerability
The LDAP backend in OpenStack Identity (Keystone) Grizzly and Havana, when removing a role on a tenant for a user who does not have that role, adds the role to the user, which allows local users to gain privileges.
- Record
GHSA-f889-wfwm-6p7m- Updated
- 2026-11-02
OSVNo score
The LDAP backend in OpenStack Identity (Keystone) Grizzly and Havana, when removing a role on a tenant for a user who does not have that role, adds the role to the user, which allows local users to gain privileges.
- Record
CVE-2013-4477- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-4477No score
The LDAP backend in OpenStack Identity (Keystone) Grizzly and Havana, when removing a role on a tenant for a user who does not have that role, adds the role to the user, which allows local users to gain privileges.
- Record
DEBIAN-CVE-2013-4477- Updated
- 2026-11-02
OSVGHSA-f889-wfwm-6p7mNo score
OpenStack Identity Keystone Privilege Escalation vulnerability
The LDAP backend in OpenStack Identity (Keystone) Grizzly and Havana, when removing a role on a tenant for a user who does not have that role, adds the role to the user, which allows local users to gain privileges.
- Record
GHSA-f889-wfwm-6p7m- Updated
- 2026-11-02
OSVPYSEC-2026-831No score
OpenStack Identity Keystone Privilege Escalation vulnerability
The LDAP backend in OpenStack Identity (Keystone) Grizzly and Havana, when removing a role on a tenant for a user who does not have that role, adds the role to the user, which allows local users to gain privileges.
- Record
PYSEC-2026-831- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
openwall.com/lists/oss-security/2013/10/30/6
ubuntu.com/usn/USN-2034-1
rhn.redhat.com/errata/RHSA-2014-0113.html
bugs.launchpad.net/keystone/+bug/1242855
nvd.nist.gov/vuln/detail/CVE-2013-4477
github.com/openstack/keystone/commit/b17e7bec768bd53d3977352486378698a3db3cfa
Show 11 moreShow less
security-tracker.debian.org/tracker/CVE-2013-4477
pypi.org/project/keystone
access.redhat.com/errata/RHSA-2014:0113
bugzilla.redhat.com/show_bug.cgi?id=1024401
security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0113.json
cve.org/CVERecord?id=CVE-2013-4477