CVE-2013-2157
OpenStack Keystone Folsom, Grizzly before 2013.1.3, and Havana, when using LDAP with Anonymous...
CVE-2013-2157 is a medium vulnerability (CVSS 4.3) in Openstack Keystone, published August 20, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.13%, the 87th percentile. Fixed in keystone 2013.1.2-1.
OpenStack Keystone Folsom, Grizzly before 2013.1.3, and Havana, when using LDAP with Anonymous binding, allows remote attackers to bypass authentication via an empty password.
Exploit likelihood
What each source reports
NVD Score used
OpenStack Keystone Folsom, Grizzly before 2013.1.3, and Havana, when using LDAP with Anonymous binding, allows remote attackers to bypass authentication via an empty password.
- Record
CVE-2013-2157- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
OpenStack Keystone Folsom, Grizzly before 2013.1.3, and Havana, when using LDAP with Anonymous binding, allows remote attackers to bypass authentication via an empty password.
- Record
CVE-2013-2157- Updated
- 2026-11-02
EUVDEUVD-2013-2122 No score
OpenStack Keystone Folsom, Grizzly before 2013.1.3, and Havana, when using LDAP with Anonymous binding, allows remote attackers to bypass authentication via an empty password.
- Record
EUVD-2013-2122- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w396-2gg4-mxgv No score
OpenStack Keystone Folsom, Grizzly before 2013.1.3, and Havana, when using LDAP with Anonymous...
OpenStack Keystone Folsom, Grizzly before 2013.1.3, and Havana, when using LDAP with Anonymous binding, allows remote attackers to bypass authentication via an empty password.
- Record
GHSA-w396-2gg4-mxgv- Weakness
- CWE-287
- Updated
- 2026-11-02
OSV No score
OpenStack Keystone Folsom, Grizzly before 2013.1.3, and Havana, when using LDAP with Anonymous binding, allows remote attackers to bypass authentication via an empty password.
- Record
CVE-2013-2157- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-2157 No score
OpenStack Keystone Folsom, Grizzly before 2013.1.3, and Havana, when using LDAP with Anonymous binding, allows remote attackers to bypass authentication via an empty password.
- Record
DEBIAN-CVE-2013-2157- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
keystoneDebian:12 |
before 2013.1.2-1 | 2013.1.2-1 |
keystoneDebian:13 |
before 2013.1.2-1 | 2013.1.2-1 |
keystoneDebian:14 |
before 2013.1.2-1 | 2013.1.2-1 |
openstack-keystoneRed Hat:openstack:3::el6 |
before 0:2013.1.2-2.el6ost | 0:2013.1.2-2.el6ost |
openstack-keystone-docRed Hat:openstack:3::el6 |
before 0:2013.1.2-2.el6ost | 0:2013.1.2-2.el6ost |
python-keystoneRed Hat:openstack:3::el6 |
before 0:2013.1.2-2.el6ost | 0:2013.1.2-2.el6ost |
openstack-keystoneRed Hat:openstack:2::el6 |
before 0:2012.2.4-3.el6ost | 0:2012.2.4-3.el6ost |
openstack-keystone-docRed Hat:openstack:2::el6 |
before 0:2012.2.4-3.el6ost | 0:2012.2.4-3.el6ost |
python-keystoneRed Hat:openstack:2::el6 |
before 0:2012.2.4-3.el6ost | 0:2012.2.4-3.el6ost |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
openwall.com/lists/oss-security/2013/06/13/3
rhn.redhat.com/errata/RHSA-2013-1083.html
securityfocus.com/bid/60545
nvd.nist.gov/vuln/detail/CVE-2013-2157
github.com/advisories/GHSA-w396-2gg4-mxgv
Show 9 moreShow less
security-tracker.debian.org/tracker/CVE-2013-2157
access.redhat.com/errata/RHSA-2013:0994
bugzilla.redhat.com/show_bug.cgi?id=971884
security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0994.json
cve.org/CVERecord?id=CVE-2013-2157