CVE-2012-3542 | Vulnetix

CVE-2012-3542 PUBLISHED CVSS 4.300000190734863 MEDIUM

OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), allows remote attackers to add an arbitrary user to an arbitrary tenant via a request to update the user's default tenant to the administrative API. NOTE: this identifier was originally incorrectly assigned to an open redirect issue, but the correct identifier for that issue is CVE-2012-3540.

EPSS 2.50% · 83.2th percentile

Risk Scores

CVSS 2.0

4.300000190734863

EPSS Score

2.50%

83.2th percentile

Affected Products

Vendor	Product	Versions
n/a	n/a	n/a
PyPI	keystone	0
openstack	horizon	folsom-3
openstack	essex	2012.1

Timeline

Sep 5, 2012 CVE Published
Feb 4, 2022 EPSS Score
Mar 29, 2022 EPSS Score
May 20, 2022 EPSS Score
Jul 12, 2022 EPSS Score
Oct 26, 2022 EPSS Score
Dec 18, 2022 EPSS Score
Feb 9, 2023 EPSS Score
Mar 7, 2023 EPSS Score
Apr 3, 2023 EPSS Score
May 25, 2023 EPSS Score
Jul 17, 2023 EPSS Score

References

50467 third-party-advisory
55326 vdb
https://github.com/openstack/keystone/commit/5438d3b5a219d7c8fa67e66e538d325a61617155 url
[openstack] 20120830 [OSSA 2012-013] Keystone, Lack of authorization for adding users to tenants (CVE-2012-3542) mailing-list
https://github.com/openstack/keystone/commit/c13d0ba606f7b2bdc609a7f388334e5efec3f3aa url
https://nvd.nist.gov/vuln/detail/CVE-2012-3542 advisory
https://bugs.launchpad.net/keystone/+bug/1040626 url
https://github.com/openstack/keystone package
https://github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2012-19.yaml url
https://web.archive.org/web/20121114023909/http://www.securityfocus.com/bid/55326 url
https://web.archive.org/web/20140802052724/http://secunia.com/advisories/50467 url
https://web.archive.org/web/20140804204333/http://secunia.com/advisories/50494 url
http://www.ubuntu.com/usn/USN-1552-1 url
http://secunia.com/advisories/50494 advisory
http://www.openwall.com/lists/oss-security/2012/08/30/6 technical

Open in Interactive Console →