CVE-2014-0204

Name: CVE-2014-0204
Creator: NVD / NIST
Published: 2014-11-03T23:55:05.297+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 1.39%

Last modified Jun 17, 2026

CVE-2014-0204 is a vulnerability of currently unknown severity. OpenStack Identity (Keystone) before 2014.1.1 does not properly handle when a role is assigned to a group that has the same ID as a user, which allows remote authenticated users to gain privileges that are assigned to a group with the same ID.. EPSS estimates a 1.39% chance of exploitation in the next 30 days.

Description

OpenStack Identity (Keystone) before 2014.1.1 does not properly handle when a role is assigned to a group that has the same ID as a user, which allows remote authenticated users to gain privileges that are assigned to a group with the same ID.

Metrics

EPSS Probability

1.39%

68.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-269

Affected Software

Vendor	Product	Versions
Openstack	Keystone	>= 2014.1, < 2014.1.1

References

http://www.openwall.com/lists/oss-security/2014/05/21/3Mailing List, Patch, Third Party Advisory
https://bugs.launchpad.net/keystone/+bug/1309228Exploit, Issue Tracking, Third Party Advisory
https://review.openstack.org/#/c/94396/Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/05/21/3Mailing List, Patch, Third Party Advisory
https://bugs.launchpad.net/keystone/+bug/1309228Exploit, Issue Tracking, Third Party Advisory
https://review.openstack.org/#/c/94396/Patch, Third Party Advisory

Timeline

Published: Nov 3, 2014
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2014-0204?

How severe is CVE-2014-0204?

Severity scoring for CVE-2014-0204 is pending analysis. The EPSS model estimates a 1.39% probability of exploitation in the next 30 days.

How do I fix CVE-2014-0204?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2014-0204?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST