{"id":"CVE-2012-3542","published":"2012-09-05T23:00:00Z","modified":"2024-08-06T20:13:50Z","title":"OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), allows remote…","vendor":null,"product":null,"tier":"tail","description":{"text":"OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), allows remote attackers to add an arbitrary user to an arbitrary tenant via a request to update the user's default tenant to the administrative API.  NOTE: this identifier was originally incorrectly assigned to an open redirect issue, but the correct identifier for that issue is CVE-2012-3540.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.025,"percentile":0.84639,"provenance":"source"},"cwes":[],"references":[{"url":"http://secunia.com/advisories/50467","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.securityfocus.com/bid/55326","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://lists.launchpad.net/openstack/msg16282.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://github.com/openstack/keystone/commit/c13d0ba606f7b2bdc609a7f388334e5efec3f3aa","tags":["x_refsource_CONFIRM"]},{"url":"http://www.openwall.com/lists/oss-security/2012/08/30/6","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://github.com/openstack/keystone/commit/5438d3b5a219d7c8fa67e66e538d325a61617155","tags":["x_refsource_CONFIRM"]},{"url":"http://secunia.com/advisories/50494","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"https://bugs.launchpad.net/keystone/+bug/1040626","tags":["x_refsource_CONFIRM"]},{"url":"http://www.ubuntu.com/usn/USN-1552-1","tags":["vendor-advisory","x_refsource_UBUNTU"]}],"priority":{"score":16.9,"factors":[{"name":"EPSS percentile","points":16.93}]},"affected":[{"ecosystem":"PyPI","package":"keystone","vulnerableRanges":["<2012.1","all versions"],"patched":["2012.1"],"from":["GHSA-gf2q-j2qq-pjf2","PYSEC-2012-19"],"provenance":"source"}],"euvd":{"id":"EUVD-2012-0013","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-openstack-keystone-cve-2012-3426","parents":[{"from":"CVE-2012-3426","to":"CVE-2012-3542","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["keystone/identity/core.py"],"commits":["https://github.com/openstack/keystone/commit/d9600434da14976463a0bd03abd8e0309f0db454","https://github.com/openstack/keystone/commit/29e74e73a6e51cffc0371b32354558391826a4aa","https://github.com/openstack/keystone/commit/c13d0ba606f7b2bdc609a7f388334e5efec3f3aa","https://github.com/openstack/keystone/commit/5438d3b5a219d7c8fa67e66e538d325a61617155"],"basis":"rarely changed file"}]}],"children":[{"from":"CVE-2012-3542","to":"CVE-2012-4456","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:keystone","fromFixed":"2012.1","toFixed":"2012.1.2","daysApart":34},{"kind":"same-code","provenance":"machine","files":["keystone/identity/core.py"],"commits":["https://github.com/openstack/keystone/commit/c13d0ba606f7b2bdc609a7f388334e5efec3f3aa","https://github.com/openstack/keystone/commit/5438d3b5a219d7c8fa67e66e538d325a61617155","https://github.com/openstack/keystone/commit/24df3adb3f50cbb5ada411bc67aba8a781e6a431","https://github.com/openstack/keystone/commit/14b136aed9d988f5a8f3e699bd4577c9b874d6c1"],"basis":"rarely changed file"},{"kind":"similar","provenance":"machine","score":0.52,"basis":"same package + description similarity"}]}],"packageHistory":[{"cve":"CVE-2026-43000","published":"2026-05-28","fixed":"29.0.2","kev":false},{"cve":"CVE-2026-43001","published":"2026-05-01","fixed":"29.0.2","kev":false},{"cve":"CVE-2026-44394","published":"2026-05-28","fixed":"29.0.2","kev":false},{"cve":"CVE-2012-3542","published":"2012-09-05","fixed":"2012.1","kev":false},{"cve":"CVE-2012-4456","published":"2012-10-09","fixed":"2012.1.2","kev":false},{"cve":"CVE-2012-4413","published":"2012-09-18","fixed":"2012.1.3","kev":false},{"cve":"CVE-2013-1865","published":"2013-03-22","fixed":"2012.2.4","kev":false}],"package":"PyPI:keystone"}}