What is the CVSS score of CVE-2013-6391?

CVE-2013-6391 has a CVSS 2.0 base score of 5.8 (Medium). CVSS vector: AV:N/AC:M/Au:N/C:P/I:P/A:N. EPSS exploitation probability: 0.5%.

Is there a public PoC exploit available for CVE-2013-6391?

Yes, a public proof-of-concept exploit is available for CVE-2013-6391. Prioritise patching immediately. EPSS: 0.5%.

Keystone CVE-2013-6391

MEDIUM

Improper Privilege Management (CWE-269)

2013-12-14 secalert@redhat.com

Privilege Escalation Keystone Ubuntu Linux Openstack

5.8

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

5.8 MEDIUM

AV:N/AC:M/Au:N/C:P/I:P/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:M/Au:N/C:P/I:P/A:N

Attack Vector

Network

Attack Complexity

Confidentiality

Integrity

Availability

None

Lifecycle Timeline

CVE Published

Dec 14, 2013 - 17:21 cve.org

MEDIUM 5.8

DescriptionCVE.org

The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows remote trust users to gain privileges by generating EC2 credentials from a trust-scoped token and using them in an ec2tokens API request.

AnalysisAI

The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows remote trust users to. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Improper Privilege Management (CWE-269), which allows attackers to escalate privileges to gain unauthorized elevated access. The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows remote trust users to gain privileges by generating EC2 credentials from a trust-scoped token and using them in an ec2tokens API request. Affected products include: Openstack Keystone, Canonical Ubuntu Linux, Redhat Openstack.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply principle of least privilege, validate privilege transitions, implement proper role separation.