CVE-2012-3542

Description

OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), allows remote attackers to add an arbitrary user to an arbitrary tenant via a request to update the user's default tenant to the administrative API. NOTE: this identifier was originally incorrectly assigned to an open redirect issue, but the correct identifier for that issue is CVE-2012-3540.

How to fix CVE-2012-3542

To remediate CVE-2012-3542, upgrade the affected package to a fixed version below.

• —upgrade to 2012.1.1-5 or later
• —upgrade to 2012.1 or later
• —upgrade to 5438d3b5a219d7c8fa67e66e538d325a61617155 or later

Is CVE-2012-3542 being exploited?

Low — EPSS is 1.9%, meaning exploitation activity has not been observed at scale.

Affected packages (3)

• from 0, < 2012.1.1-5
• from 0, < 2012.1
• from 0, < 5438d3b5a219d7c8fa67e66e538d325a61617155, < c13d0ba606f7b2bdc609a7f388334e5efec3f3aa | from 0

CVSS scores

References (17)

• ADVISORYsecunia.com/advisories/50467
• ADVISORYsecunia.com/advisories/50494
• ADVISORYgithub.com/advisories/GHSA-gf2q-j2qq-pjf2
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2012-3542
• ADVISORYsecurity-tracker.debian.org