CVE-2014-3520

OpenStack Identity (Keystone) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticated trustees to gain access to an unauthorized project for which the trustor has certain roles via the project ID in a V2 API trust token request.

• CWE-863

• http://lists.openstack.org/pipermail/openstack-announce/2014-July/000248.htmlPatch, Vendor Advisory
• http://secunia.com/advisories/59426Third Party Advisory
• https://bugs.launchpad.net/keystone/+bug/1331912Exploit, Issue Tracking, Third Party Advisory
• http://lists.openstack.org/pipermail/openstack-announce/2014-July/000248.htmlPatch, Vendor Advisory
• http://secunia.com/advisories/59426Third Party Advisory
• https://bugs.launchpad.net/keystone/+bug/1331912Exploit, Issue Tracking, Third Party Advisory

Published

Oct 26, 2014

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-3514activerecord/lib/active_record/relation/query_methods.rb in …
• CVE-2014-3515The SPL component in PHP before 5.4.30 and 5.5.x before 5.5.…
• CVE-2014-3516Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2014-3517api/metadata/handler.py in OpenStack Compute (Nova) before 2…
• CVE-2014-3518jmx-remoting.sar in JBoss Remoting, as used in Red Hat JBoss…
• CVE-2014-3519The open_by_handle_at function in vzkernel before 042stab090…
• CVE-2014-3521The component in (1) /luci/homebase and (2) /luci/cluster me…
• CVE-2014-3522The Serf RA layer in Apache Subversion 1.4.0 through 1.7.x b…
• CVE-2014-3523Memory leak in the winnt_accept function in server/mpm/winnt…
• CVE-2014-3524Apache OpenOffice before 4.1.1 allows remote attackers to ex…
• CVE-2014-3525Unspecified vulnerability in Apache Traffic Server 3.x throu…
• CVE-2014-3526Apache Wicket before 1.5.12, 6.x before 6.17.0, and 7.x befo…7.5