CVE-2012-3542 OpenStack Keystone Allows Remote User Account Creation
MediumCVSS 4.3
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), allows remote attackers to add an arbitrary user to an arbitrary tenant via a request to update the user's default tenant to the administrative API. NOTE: this identifier was originally incorrectly assigned to an open redirect issue, but the correct identifier for that issue is CVE-2012-3540.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi keystone(PyPI) | < 2012.1 | 2012.1 |
| pypi keystone(PyPI) | = 12.0.2 | No fix listed |
| pypi keystone(PyPI) | = 12.0.3 | No fix listed |
| pypi keystone(PyPI) | = 13.0.2 | No fix listed |
| pypi keystone(PyPI) | = 13.0.3 | No fix listed |
| pypi keystone(PyPI) | = 13.0.4 | No fix listed |
| pypi keystone(PyPI) | = 14.0.0 | No fix listed |
| pypi keystone(PyPI) | = 14.0.1 | No fix listed |
| pypi keystone(PyPI) | = 14.1.0 | No fix listed |
| pypi keystone(PyPI) | = 14.2.0 | No fix listed |
| pypi keystone(PyPI) | = 15.0.0 | No fix listed |
| pypi keystone(PyPI) | = 15.0.0.0rc1 | No fix listed |
| pypi keystone(PyPI) | = 15.0.0.0rc2 | No fix listed |
| pypi keystone(PyPI) | = 15.0.1 | No fix listed |
| pypi keystone(PyPI) | = 16.0.0 | No fix listed |
| pypi keystone(PyPI) | = 16.0.0.0rc1 | No fix listed |
| pypi keystone(PyPI) | = 16.0.0.0rc2 | No fix listed |
| pypi keystone(PyPI) | = 16.0.1 | No fix listed |
| pypi keystone(PyPI) | = 16.0.2 | No fix listed |
| pypi keystone(PyPI) | = 17.0.0 | No fix listed |
| pypi keystone(PyPI) | = 17.0.0.0rc1 | No fix listed |
| pypi keystone(PyPI) | = 17.0.0.0rc2 | No fix listed |
| pypi keystone(PyPI) | = 17.0.1 | No fix listed |
| pypi keystone(PyPI) | = 18.0.0 | No fix listed |
| pypi keystone(PyPI) | = 18.0.0.0rc1 | No fix listed |
Show 58 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi keystone(PyPI) | = 18.1.0 | No fix listed |
| pypi keystone(PyPI) | = 19.0.0 | No fix listed |
| pypi keystone(PyPI) | = 19.0.0.0rc1 | No fix listed |
| pypi keystone(PyPI) | = 19.0.0.0rc2 | No fix listed |
| pypi keystone(PyPI) | = 19.0.1 | No fix listed |
| pypi keystone(PyPI) | = 20.0.0 | No fix listed |
| pypi keystone(PyPI) | = 20.0.0.0rc1 | No fix listed |
| pypi keystone(PyPI) | = 20.0.1 | No fix listed |
| pypi keystone(PyPI) | = 21.0.0 | No fix listed |
| pypi keystone(PyPI) | = 21.0.0.0rc1 | No fix listed |
| pypi keystone(PyPI) | = 21.0.1 | No fix listed |
| pypi keystone(PyPI) | = 22.0.0 | No fix listed |
| pypi keystone(PyPI) | = 22.0.0.0rc1 | No fix listed |
| pypi keystone(PyPI) | = 22.0.1 | No fix listed |
| pypi keystone(PyPI) | = 22.0.2 | No fix listed |
| pypi keystone(PyPI) | = 23.0.0 | No fix listed |
| pypi keystone(PyPI) | = 23.0.0.0rc1 | No fix listed |
| pypi keystone(PyPI) | = 23.0.1 | No fix listed |
| pypi keystone(PyPI) | = 23.0.2 | No fix listed |
| pypi keystone(PyPI) | = 24.0.0 | No fix listed |
| pypi keystone(PyPI) | = 24.0.0.0rc1 | No fix listed |
| pypi keystone(PyPI) | = 24.1.0 | No fix listed |
| pypi keystone(PyPI) | = 25.0.0 | No fix listed |
| pypi keystone(PyPI) | = 25.0.0.0rc1 | No fix listed |
| pypi keystone(PyPI) | = 26.0.0 | No fix listed |
| pypi keystone(PyPI) | = 26.0.0.0rc1 | No fix listed |
| pypi keystone(PyPI) | = 26.1.0 | No fix listed |
| pypi keystone(PyPI) | = 26.1.1 | No fix listed |
| pypi keystone(PyPI) | = 27.0.0 | No fix listed |
| pypi keystone(PyPI) | = 27.0.0.0rc1 | No fix listed |
| pypi keystone(PyPI) | = 27.0.1 | No fix listed |
| pypi keystone(PyPI) | = 27.0.2 | No fix listed |
| pypi keystone(PyPI) | = 27.1.0 | No fix listed |
| pypi keystone(PyPI) | = 28.0.0 | No fix listed |
| pypi keystone(PyPI) | = 28.0.0.0rc1 | No fix listed |
| pypi keystone(PyPI) | = 28.0.1 | No fix listed |
| pypi keystone(PyPI) | = 28.0.2 | No fix listed |
| pypi keystone(PyPI) | = 28.1.0 | No fix listed |
| pypi keystone(PyPI) | = 29.0.0 | No fix listed |
| pypi keystone(PyPI) | = 29.0.0.0rc1 | No fix listed |
| pypi keystone(PyPI) | = 29.0.1 | No fix listed |
| pypi keystone(PyPI) | = 29.0.2 | No fix listed |
| pypi keystone(PyPI) | = 29.1.0 | No fix listed |
| pypi keystone(PyPI) | All versions | No fix listed |
| pypi keystone(PyPI) | = 2012.1.2 | No fix listed |
| pypi keystone(PyPI) | = folsom-2 | No fix listed |
| pypi keystone(PyPI) | = 2012.1.1 | No fix listed |
| pypi keystone(PyPI) | = folsom-1 | No fix listed |
| pypi keystone(PyPI) | = essex-rc2 | No fix listed |
| pypi keystone(PyPI) | = 2012.1 | No fix listed |
| pypi keystone(PyPI) | = essex-rc1 | No fix listed |
| pypi keystone(PyPI) | = essex-4 | No fix listed |
| pypi keystone(PyPI) | = 2011.3 | No fix listed |
| debian/keystone(Debian:12) | < 2012.1.1-5 | 2012.1.1-5 |
| debian/keystone(Debian:13) | < 2012.1.1-5 | 2012.1.1-5 |
| debian/keystone(Debian:14) | < 2012.1.1-5 | 2012.1.1-5 |
| OpenStack essex | = 2012.1 | No fix listed |
| OpenStack horizon | = folsom-3 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- bugs.launchpad.net
- github.com product
- github.com
- [openstack] 20120830 [OSSA 2012-013] Keystone, Lack of authorization for adding users to tenants (CVE-2012-3542) mailing-list
- web.archive.org
- web.archive.org
- web.archive.org
- [oss-security] 20120830 [OSSA 2012-013] Keystone, Lack of authorization for adding users to tenants (CVE-2012-3542) mailing-list
- USN-1552-1 vendor-advisory
- 50467 third-party-advisory vendor-advisory
- 55326 vdb-entry
- 50494 third-party-advisory vendor-advisory
- github.com vendor-advisory
- Debian Security Tracker CVE-2012-3542 vendor-advisory