CVE-2012-3542: OpenStack Keystone Allows Remote User Account Creation
(updated )
OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), allows remote attackers to add an arbitrary user to an arbitrary tenant via a request to update the user’s default tenant to the administrative API. NOTE: this identifier was originally incorrectly assigned to an open redirect issue, but the correct identifier for that issue is CVE-2012-3540.
References
- bugs.launchpad.net/keystone/+bug/1040626
- github.com/advisories/GHSA-gf2q-j2qq-pjf2
- github.com/openstack/keystone
- github.com/openstack/keystone/commit/5438d3b5a219d7c8fa67e66e538d325a61617155
- github.com/openstack/keystone/commit/c13d0ba606f7b2bdc609a7f388334e5efec3f3aa
- github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2012-19.yaml
- lists.launchpad.net/openstack/msg16282.html
- nvd.nist.gov/vuln/detail/CVE-2012-3542
- web.archive.org/web/20121114023909/http://www.securityfocus.com/bid/55326
- web.archive.org/web/20140802052724/http://secunia.com/advisories/50467
- web.archive.org/web/20140804204333/http://secunia.com/advisories/50494
Code Behaviors & Features
Detect and mitigate CVE-2012-3542 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →