### [CVE-2012-4456](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4456)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)

### Description

The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services.

### POC

#### Reference
- https://github.com/openstack/keystone/commit/24df3adb3f50cbb5ada411bc67aba8a781e6a431

#### Github
No PoCs found on GitHub currently.