# CVE-2012-3540: PYSEC-2012-18 - Open redirect vulnerability in views/auth_forms.py in OpenStack Dashboard (Horizon) Essex (2012.1)…

Source: https://junglewise.ai/threats/cve-2012-3540-pysec-2012-18-open-redirect-vulnerability-in-views-auth-forms-py  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2012-09-05  
License: CC BY 4.0 with a link back

CVE-2012-3540 · Severity: info · Published 2012-09-05

Open redirect vulnerability in views/auth_forms.py in OpenStack Dashboard (Horizon) Essex (2012.1) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter to auth/login/.  NOTE: this issue was originally assigned CVE-2012-3542 by mistake.

Technologies: [horizon (PyPI)](https://junglewise.ai/threats/technologies/horizon). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2012-3540 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2012-3540 being exploited in the wild.

**How severe is CVE-2012-3540?** Informational severity, published 5 September 2012.

**Which products and versions are affected?** horizon (PyPI) GIT:introduced=0,fixed=35eada8a27323c0f83c400177797927aba6bc99b|ECOSYSTEM:introduced=0.

**Is there a fix for CVE-2012-3540?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2012-3540?** Check whether you run horizon (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- horizon (PyPI) GIT:introduced=0,fixed=35eada8a27323c0f83c400177797927aba6bc99b|ECOSYSTEM:introduced=0

## Identifiers

- CVE-2012-3540
- PYSEC-2012-18

## Related threats

- [PYSEC-2026-821 - OpenStack Horizon Cross-site Scripting (XSS)](https://junglewise.ai/threats/cve-2017-7400-openstack-horizon-cross-site-scripting-xss)
- [PYSEC-2026-822 - OpenStack Dashboard (aka Horizon) vulnerable to Cross-site Scripting](https://junglewise.ai/threats/cve-2014-0157-openstack-dashboard-aka-horizon-vulnerable-to-cross-site-scripting)
- [PYSEC-2026-642 - Horizon-Orchestration Cross-site scripting (XSS) vulnerability through resource name](https://junglewise.ai/threats/cve-2014-3473-horizon-orchestration-cross-site-scripting-xss-vulnerability)
- [PYSEC-2026-644 - OpenStack Horizon Cross-site scripting (XSS) vulnerability](https://junglewise.ai/threats/cve-2014-3474-openstack-horizon-cross-site-scripting-xss-vulnerability)
- [PYSEC-2026-641 - OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability in the Host Aggregates interface](https://junglewise.ai/threats/cve-2014-3594-openstack-dashboard-horizon-cross-site-scripting-xss-vulnerability)