CVE-2012-3542
OpenStack Keystone Allows Remote User Account Creation
OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), allows remote attackers to add an arbitrary user to an arbitrary tenant via a request to update the user's default tenant to the administrative API. NOTE: this identifier was originally incorrectly assigned to an open redirect issue, but the correct identifier for that issue is CVE-2012-3540.
Exploit likelihood
What each source reports
NVD Score used
OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), allows remote attackers to add an arbitrary user to an arbitrary tenant via a request to update the user's default tenant to the administrative API. NOTE: this identifier was originally incorrectly assigned to an open redirect issue, but the correct identifier for that issue is CVE-2012-3540.
- Record
CVE-2012-3542- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), allows remote attackers to add an arbitrary user to an arbitrary tenant via a request to update the user's default tenant to the administrative API. NOTE: this identifier was originally incorrectly assigned to an open redirect issue, but the correct identifier for that issue is CVE-2012-3540.
- Record
CVE-2012-3542- Updated
- 2026-11-02
EUVDEUVD-2012-0013 No score
OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), allows remote attackers to add an arbitrary user to an arbitrary tenant via a request to update the user's default tenant to the administrative API. NOTE: this identifier was originally incorrectly assigned to an open redirect issue, but the correct identifier for that issue is CVE-2012-3540.
- Record
EUVD-2012-0013- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gf2q-j2qq-pjf2
OpenStack Keystone Allows Remote User Account Creation
OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), allows remote attackers to add an arbitrary user to an arbitrary tenant via a request to update the user's default tenant to the administrative API. NOTE: this identifier was originally incorrectly assigned to an open redirect issue, but the correct identifier for that issue is CVE-2012-3540.
- Record
GHSA-gf2q-j2qq-pjf2- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVGHSA-gf2q-j2qq-pjf2
OpenStack Keystone Allows Remote User Account Creation
OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), allows remote attackers to add an arbitrary user to an arbitrary tenant via a request to update the user's default tenant to the administrative API. NOTE: this identifier was originally incorrectly assigned to an open redirect issue, but the correct identifier for that issue is CVE-2012-3540.
- Record
GHSA-gf2q-j2qq-pjf2- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSV No score
OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), allows remote attackers to add an arbitrary user to an arbitrary tenant via a request to update the user's default tenant to the administrative API. NOTE: this identifier was originally incorrectly assigned to an open redirect issue, but the correct identifier for that issue is CVE-2012-3540.
- Record
CVE-2012-3542- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-3542 No score
OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), allows remote attackers to add an arbitrary user to an arbitrary tenant via a request to update the user's default tenant to the administrative API. NOTE: this identifier was originally incorrectly assigned to an open redirect issue, but the correct identifier for that issue is CVE-2012-3540.
- Record
DEBIAN-CVE-2012-3542- Updated
- 2026-11-02
OSVPYSEC-2012-19 No score
OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), allows remote attackers to add an arbitrary user to an arbitrary tenant via a request to update the user's default tenant to the administrative API. NOTE: this identifier was originally incorrectly assigned to an open redirect issue, but the correct identifier for that issue is CVE-2012-3540.
- Record
PYSEC-2012-19- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
keystonePyPI |
before 2012.1 | 2012.1 |
keystoneDebian:12 |
before 2012.1.1-5 | 2012.1.1-5 |
keystoneDebian:13 |
before 2012.1.1-5 | 2012.1.1-5 |
keystoneDebian:14 |
before 2012.1.1-5 | 2012.1.1-5 |
keystonePyPI |
before 2012.1, plus listed versions 12.0.212.0.313.0.213.0.313.0.4 Show 45 moreShow less14.0.014.0.114.1.014.2.015.0.015.0.0.0rc115.0.0.0rc215.0.116.0.016.0.0.0rc116.0.0.0rc216.0.116.0.217.0.017.0.0.0rc117.0.0.0rc217.0.118.0.018.0.0.0rc118.1.019.0.019.0.0.0rc119.0.0.0rc219.0.120.0.020.0.0.0rc120.0.121.0.021.0.0.0rc121.0.122.0.022.0.0.0rc122.0.122.0.223.0.023.0.0.0rc123.0.123.0.224.0.024.0.0.0rc124.1.025.0.025.0.0.0rc126.0.026.0.0.0rc1 |
2012.1 |
keystonePyPI |
All versions, plus listed versions 12.0.212.0.313.0.213.0.313.0.4 Show 45 moreShow less14.0.014.0.114.1.014.2.015.0.015.0.0.0rc115.0.0.0rc215.0.116.0.016.0.0.0rc116.0.0.0rc216.0.116.0.217.0.017.0.0.0rc117.0.0.0rc217.0.118.0.018.0.0.0rc118.1.019.0.019.0.0.0rc119.0.0.0rc219.0.120.0.020.0.0.0rc120.0.121.0.021.0.0.0rc121.0.122.0.022.0.0.0rc122.0.122.0.223.0.023.0.0.0rc123.0.123.0.224.0.024.0.0.0rc124.1.025.0.025.0.0.0rc126.0.026.0.0.0rc1 |
None known |
openstack-keystoneRed Hat:openstack:1::el6 |
before 0:2012.1.2-4.el6 | 0:2012.1.2-4.el6 |
openstack-keystone-docRed Hat:openstack:1::el6 |
before 0:2012.1.2-4.el6 | 0:2012.1.2-4.el6 |
python-keystoneRed Hat:openstack:1::el6 |
before 0:2012.1.2-4.el6 | 0:2012.1.2-4.el6 |
python-keystone-auth-tokenRed Hat:openstack:1::el6 |
before 0:2012.1.2-4.el6 | 0:2012.1.2-4.el6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-3542 is a medium vulnerability (CVSS 4.3) in Openstack Essex, published September 5, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.50%, the 84th percentile. Fixed in keystone 2012.1.
References
secunia.com/advisories/50467
securityfocus.com/bid/55326
lists.launchpad.net/openstack/msg16282.html
github.com/openstack/keystone/commit/c13d0ba606f7b2bdc609a7f388334e5efec3f3aa
openwall.com/lists/oss-security/2012/08/30/6
Show 29 moreShow less
bugs.launchpad.net/keystone/+bug/1040626
ubuntu.com/usn/USN-1552-1
nvd.nist.gov/vuln/detail/CVE-2012-3542
web.archive.org/web/20121114023909/http://www.securityfocus.com/bid/55326
security-tracker.debian.org/tracker/CVE-2012-3542
access.redhat.com/errata/RHSA-2012:1378
bugzilla.redhat.com/show_bug.cgi?id=852510
security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1378.json
cve.org/CVERecord?id=CVE-2012-3542
Left out here: 37 versions. The JSON record has them.