5.8

CVE-2012-3540

Exploit
Open redirect vulnerability in views/auth_forms.py in OpenStack Dashboard (Horizon) Essex (2012.1) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter to auth/login/.  NOTE: this issue was originally assigned CVE-2012-3542 by mistake.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Openstack ≫ Horizon Version2012.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.9% 0.851
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.8 8.6 4.9
AV:N/AC:M/Au:N/C:P/I:P/A:N
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://secunia.com/advisories/50480
Vendor Advisory
http://www.openwall.com/lists/oss-security/2012/08/30/4
http://www.openwall.com/lists/oss-security/2012/08/30/5
http://www.securityfocus.com/bid/55329
http://www.ubuntu.com/usn/USN-1565-1
https://bugs.launchpad.net/horizon/+bug/1039077
https://exchange.xforce.ibmcloud.com/vulnerabilities/78196
https://github.com/openstack/horizon/commit/35eada8a27323c0f83c400177797927aba6bc99b
Patch
Exploit
https://lists.launchpad.net/openstack/msg16278.html
https://lists.launchpad.net/openstack/msg16281.html