{"id":"CVE-2012-3540","aliases":["DEBIAN-CVE-2012-3540","EUVD-2012-0009","GHSA-j72v-mpwp-rg79","PYSEC-2012-18","RHSA-2012:1380"],"status":"published","title":"Open redirect vulnerability in views/auth_forms.py in OpenStack Dashboard (Horizon) Essex (2012.1...","description":"Open redirect vulnerability in views/auth_forms.py in OpenStack Dashboard (Horizon) Essex (2012.1) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter to auth/login/.  NOTE: this issue was originally assigned CVE-2012-3542 by mistake.","severity":{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02908,"percentile":0.87071,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2012-09-05T23:00:00Z","modified":"2026-10-23T17:47:48Z","fixes":[{"ecosystem":"Debian:12","package":"horizon","fixed_in":["2012.1.1-4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"horizon","fixed_in":["2012.1.1-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"horizon","fixed_in":["2012.1.1-4"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:1::el6","package":"openstack-dashboard","fixed_in":["0:2012.1.1-3.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:1::el6","package":"python-django-horizon","fixed_in":["0:2012.1.1-3.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:1::el6","package":"python-django-horizon-doc","fixed_in":["0:2012.1.1-3.el6"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2012.1.1-4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2012.1.1-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2012.1.1-4"}]}]},{"source":"osv","ecosystem":"PyPI","package":"horizon","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"35eada8a27323c0f83c400177797927aba6bc99b"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.0.2","12.0.3","12.0.4","13.0.0","13.0.0.0b3","13.0.0.0rc1","13.0.0.0rc2","13.0.1","13.0.2","13.0.3","14.0.0","14.0.0.0b1","14.0.0.0b2","14.0.0.0b3","14.0.0.0rc1","14.0.0.0rc2","14.0.1","14.0.2","14.0.3","14.0.4","14.1.0","15.0.0","15.0.0.0b1","15.0.0.0b2","15.0.0.0rc1","15.0.0.0rc2","15.1.0","15.1.1","15.2.0","15.3.0","15.3.1","15.3.2","16.0.0","16.0.0.0b1","16.0.0.0b2","16.0.0.0rc1","16.0.0.0rc2","16.1.0","16.2.0","16.2.1","16.2.2","17.0.0","17.1.0","18.0.0","18.1.0","18.2.0","18.3.0","18.3.1","18.3.2","18.3.3","18.3.4","18.3.5","18.4.0","18.4.1","18.5.0","18.6.0","18.6.1","18.6.2","18.6.3","18.6.4","19.0.0","19.1.0","19.2.0","19.3.0","19.4.0","20.0.0","20.1.0","20.1.1","20.1.2","20.1.3","20.1.4","20.2.0","21.0.0","22.0.0","22.1.0","22.1.1","22.2.0","23.0.0","23.1.0","23.2.0","23.3.0","23.0.1","23.0.2","23.1.1","23.3.1","23.4.0","24.0.0","24.0.1","24.0.2","25.0.0","25.1.0","25.1.1","25.2.0","25.3.0","25.3.1","25.4.0","25.5.0","25.5.1"]},{"source":"osv","ecosystem":"Red Hat:openstack:1::el6","package":"openstack-dashboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2012.1.1-3.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:1::el6","package":"python-django-horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2012.1.1-3.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:1::el6","package":"python-django-horizon-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2012.1.1-3.el6"}]}]}],"products":[{"vendor":"openstack","product":"horizon"}],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/78196","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"https://bugs.launchpad.net/horizon/+bug/1039077","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2012/08/30/4","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://github.com/openstack/horizon/commit/35eada8a27323c0f83c400177797927aba6bc99b","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","evidence","fix"]},{"url":"http://www.ubuntu.com/usn/USN-1565-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/55329","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://lists.launchpad.net/openstack/msg16281.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://secunia.com/advisories/50480","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2012/08/30/5","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.launchpad.net/openstack/msg16278.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-3540","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-j72v-mpwp-rg79"},{"url":"https://security-tracker.debian.org/tracker/CVE-2012-3540","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2012:1380","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=852246","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_1380.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-3540","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-3540","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2012-3540","description":"Open redirect vulnerability in views/auth_forms.py in OpenStack Dashboard (Horizon) Essex (2012.1) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter to auth/login/.  NOTE: this issue was originally assigned CVE-2012-3542 by mistake.","status":"published","published":"2012-09-05T23:00:00Z","modified":"2024-08-06T20:13:50.055Z","updated_at":"2026-11-02T14:34:50.94153Z"}],"euvd":[{"id":"EUVD-2012-0009","description":"Open redirect vulnerability in views/auth_forms.py in OpenStack Dashboard (Horizon) Essex (2012.1) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter to auth/login/.  NOTE: this issue was originally assigned CVE-2012-3542 by mistake.","status":"published","published":"2012-09-05T23:00:00Z","modified":"2024-08-06T20:13:50Z","updated_at":"2026-11-03T01:56:10.361197Z"}],"ghsa":[{"id":"GHSA-j72v-mpwp-rg79","title":"Open redirect vulnerability in views/auth_forms.py in OpenStack Dashboard (Horizon) Essex (2012.1...","description":"Open redirect vulnerability in views/auth_forms.py in OpenStack Dashboard (Horizon) Essex (2012.1) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter to auth/login/.  NOTE: this issue was originally assigned CVE-2012-3542 by mistake.","status":"published","published":"2022-05-17T01:43:43Z","modified":"2023-02-03T05:05:01Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:53:40.095446Z"}],"nvd":[{"id":"CVE-2012-3540","description":"Open redirect vulnerability in views/auth_forms.py in OpenStack Dashboard (Horizon) Essex (2012.1) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter to auth/login/.  NOTE: this issue was originally assigned CVE-2012-3542 by mistake.","status":"published","published":"2012-09-05T23:55:02.46Z","modified":"2026-06-16T23:43:26.117Z","cvss":[{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:15.643902Z"}],"osv":[{"id":"CVE-2012-3540","description":"Open redirect vulnerability in views/auth_forms.py in OpenStack Dashboard (Horizon) Essex (2012.1) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter to auth/login/.  NOTE: this issue was originally assigned CVE-2012-3542 by mistake.","status":"published","published":"2012-09-05T23:55:02Z","modified":"2026-04-10T03:42:24.52195Z","updated_at":"2026-11-02T15:43:58.537032Z"},{"id":"DEBIAN-CVE-2012-3540","description":"Open redirect vulnerability in views/auth_forms.py in OpenStack Dashboard (Horizon) Essex (2012.1) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter to auth/login/.  NOTE: this issue was originally assigned CVE-2012-3542 by mistake.","status":"published","published":"2012-09-05T23:55:02.46Z","modified":"2026-10-23T17:47:48.820474935Z","updated_at":"2026-11-02T15:45:24.92418Z"},{"id":"PYSEC-2012-18","description":"Open redirect vulnerability in views/auth_forms.py in OpenStack Dashboard (Horizon) Essex (2012.1) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter to auth/login/.  NOTE: this issue was originally assigned CVE-2012-3542 by mistake.","status":"published","published":"2012-09-05T23:55:00Z","modified":"2025-10-09T05:18:21.626755Z","updated_at":"2026-11-02T15:52:51.254177Z"},{"id":"RHSA-2012:1380","title":"Red Hat Security Advisory: python-django-horizon security update","status":"published","published":"2024-09-15T20:16:21Z","modified":"2026-08-08T10:15:04.225643776Z","updated_at":"2026-11-02T15:53:01.495018Z"}]}}