CVE-2012-3540: Input Validation

Published Sep 5, 2012

Updated

Open redirect vulnerability in views/authforms.py in OpenStack Dashboard (Horizon) Essex (2012.1) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter to auth/login/. NOTE: this issue was originally assigned CVE-2012-3542 by mistake.

Affected Software

1 affected component

Openstack Horizon=2012.1

Remediation

Patch Available

https://github.com/openstack/horizon/commit/35eada8a27323c0f83c400177797927aba6bc99b

Event History

Sep 5, 2012

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2012-3540?

CVE-2012-3540 is classified as a medium severity vulnerability due to its potential for phishing attacks.

How does CVE-2012-3540 affect users?

CVE-2012-3540 allows attackers to redirect users to malicious websites, increasing the risk of phishing.

How do I fix CVE-2012-3540?

CVE-2012-3540 can be mitigated by upgrading OpenStack Horizon to a version later than 2012.1 that addresses this vulnerability.

What versions of OpenStack Horizon are affected by CVE-2012-3540?

CVE-2012-3540 affects OpenStack Horizon version 2012.1.

Is there a way to prevent exploitation of CVE-2012-3540?

Implementing strict validation for URLs in the next parameter on the auth/login/ endpoint can help prevent exploitation of CVE-2012-3540.