CVE-2012-3540: PYSEC-2012-18 - Open redirect vulnerability in views/auth_forms.py in OpenStack Dashboard (Horizon) Essex (2012.1)…

CVE-2012-3540 · Severity: info · Published 2012-09-05

Open redirect vulnerability in views/auth_forms.py in OpenStack Dashboard (Horizon) Essex (2012.1) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter to auth/login/. NOTE: this issue was originally assigned CVE-2012-3542 by mistake.

Technologies: horizon (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2012-3540 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2012-3540 being exploited in the wild.
How severe is CVE-2012-3540?
Informational severity, published 5 September 2012.
Which products and versions are affected?
horizon (PyPI) GIT:introduced=0,fixed=35eada8a27323c0f83c400177797927aba6bc99b|ECOSYSTEM:introduced=0.
Is there a fix for CVE-2012-3540?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
Am I affected by CVE-2012-3540?
Check whether you run horizon (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Affected products

  • horizon (PyPI) GIT:introduced=0,fixed=35eada8a27323c0f83c400177797927aba6bc99b|ECOSYSTEM:introduced=0

Identifiers

  • CVE-2012-3540
  • PYSEC-2012-18

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.