CVE-2012-3542

2012-09-0523:55:02

CWE-264

redhat

web.nvd.nist.gov

openstack

keystone

folsom

cve

security

vulnerability

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

6.5

Confidence

Low

EPSS

0.008

Percentile

81.6%

JSON

OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), allows remote attackers to add an arbitrary user to an arbitrary tenant via a request to update the user’s default tenant to the administrative API. NOTE: this identifier was originally incorrectly assigned to an open redirect issue, but the correct identifier for that issue is CVE-2012-3540.

Affected configurations

Nvd

Node

openstackessexMatch2012.1

openstackhorizonMatchfolsom-3

VendorProductVersionCPE
openstackessex2012.1cpe:2.3:a:openstack:essex:2012.1:*:*:*:*:*:*:*
openstackhorizonfolsom-3cpe:2.3:a:openstack:horizon:folsom-3:*:*:*:*:*:*:*