CVE-2012-5474

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-12-30 · updated 2026-06-16
Weakness: CWE-311

Description

The file /etc/openstack-dashboard/local_settings within Red Hat OpenStack Platform 2.0 and RHOS Essex Release (python-django-horizon package before 2012.1.1) is world readable and exposes the secret key value.

Affected products

Debian Linux: 8.0, 9.0, 10.0
Fedoraproject Fedora: 18
OpenStack Horizon: from 2012.1 before 2012.1.1 — fixed in 2012.1.1
OpenStack: 2.0

How to fix

Upgrade to a fixed version: OpenStack Horizon 2012.1.1. Check the vendor advisory for mitigations.

References

http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092841.html
https://access.redhat.com/security/cve/cve-2012-5474
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-5474
https://security-tracker.debian.org/tracker/CVE-2012-5474
http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092841.html
https://access.redhat.com/security/cve/cve-2012-5474
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-5474
https://security-tracker.debian.org/tracker/CVE-2012-5474

Get alerted when CVE-2012-5474 or the next vulnerability affects your stack