CVE-2017-12440

Name: CVE-2017-12440
Creator: NVD / NIST
Published: 2017-08-18T14:29:00.377+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 2.14%

Last modified Jun 17, 2026

CVE-2017-12440 is a vulnerability of currently unknown severity. Aodh as packaged in Openstack Ocata and Newton before change-ID I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 and before Pike-rc1 does not verify that trust IDs belong to the user when creating alarm action with the scheme trust+http, which allows remote authenticated users with knowledge of trust IDs where Aodh is the trustee to obtain a Keystone token and perform unspecified authenticated actions by adding an alarm action with the scheme trust+http, and providing a trust id where Aodh is the trustee.. EPSS estimates a 2.14% chance of exploitation in the next 30 days.

Description

Aodh as packaged in Openstack Ocata and Newton before change-ID I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 and before Pike-rc1 does not verify that trust IDs belong to the user when creating alarm action with the scheme trust+http, which allows remote authenticated users with knowledge of trust IDs where Aodh is the trustee to obtain a Keystone token and perform unspecified authenticated actions by adding an alarm action with the scheme trust+http, and providing a trust id where Aodh is the trustee.

Metrics

EPSS Probability

2.14%

79.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-306

Affected Software

Vendor	Product	Versions
Openstack	Openstack	07132017

References

http://www.debian.org/security/2017/dsa-3953
http://www.securityfocus.com/bid/100455Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:3227
https://access.redhat.com/errata/RHSA-2018:0315
https://bugs.launchpad.net/ossn/+bug/1649333Issue Tracking, Patch, Third Party Advisory
https://review.openstack.org/#/c/493823/Issue Tracking, Patch, Vendor Advisory
https://review.openstack.org/#/c/493824/Issue Tracking, Patch, Vendor Advisory
https://review.openstack.org/#/c/493826/Issue Tracking, Patch, Vendor Advisory
http://www.debian.org/security/2017/dsa-3953
http://www.securityfocus.com/bid/100455Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:3227
https://access.redhat.com/errata/RHSA-2018:0315
https://bugs.launchpad.net/ossn/+bug/1649333Issue Tracking, Patch, Third Party Advisory
https://review.openstack.org/#/c/493823/Issue Tracking, Patch, Vendor Advisory
https://review.openstack.org/#/c/493824/Issue Tracking, Patch, Vendor Advisory
https://review.openstack.org/#/c/493826/Issue Tracking, Patch, Vendor Advisory

Timeline

Published: Aug 18, 2017
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2017-12440?

How severe is CVE-2017-12440?

Severity scoring for CVE-2017-12440 is pending analysis. The EPSS model estimates a 2.14% probability of exploitation in the next 30 days.

How do I fix CVE-2017-12440?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2017-12440?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST