CVE-2012-3540: Open Redirect Vulnerability in OpenStack Dashboard (Horizon) Essex (2012.1)
Summary
CVE-2012-3540: Open redirect vulnerability in views/auth_forms.py in OpenStack Dashboard (Horizon) Essex (2012.1) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next param... Affects horizon versions < 35eada8a27323c0f83c400177797927aba6bc99b. Fixed in 35eada8a27323c0f83c400177797927aba6bc99b. How to fix ↓
Also tracked for
- horizon · Debian:11
The same CVE-2012-3540 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenStack Dashboard, also known as Horizon, is a web-based interface for managing OpenStack services. It provides a graphical user interface (GUI) for users to interact with OpenStack resources such as virtual machines, networks, and storage. Horizon is written in Python and is available on the Python Package Index (PyPI). This vulnerability affects the Essex (2012.1) release of Horizon.
Vulnerability Detail
The Open Redirect vulnerability in Horizon allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks. The vulnerability exists in the 'views/auth_forms.py' file of Horizon. Attackers can exploit this vulnerability by providing a malicious URL in the 'next' parameter of the 'auth/login/' endpoint. When a user submits their login credentials, they will be redirected to the specified URL, which can be controlled by the attacker. This can lead to phishing attacks where users are tricked into entering their credentials on a fake website.
How To Fix
Latest published version: 27.0.0 as of 22 Oct 2026
pip install --upgrade "horizon==27.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
35eada8a27323c0f83c400177797927aba6bc99b
This is the first release that contains the fix.
pip install --upgrade "horizon==35eada8a27323c0f83c400177797927aba6bc99b"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix mentioned in the 'how_to_fix' section.
Conclusion
The Open Redirect vulnerability in OpenStack Dashboard (Horizon) Essex (2012.1) allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks. It is recommended to upgrade to a fixed version of Horizon to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for horizon →
FAQ
This vulnerability allows attackers to redirect users to malicious websites and conduct phishing attacks. Users may unknowingly enter their login credentials on a fake website, leading to potential account compromise.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Horizon installation is affected by this vulnerability. Simply provide your Pipfile.lock file, and Vulert will analyze it for any known vulnerabilities, including this one.
There are no known public exploits for this vulnerability at the time of this report. However, it is important to apply the fix as soon as possible to mitigate the risk.
No, upgrading to a fixed version is the recommended solution. Applying the fix ensures that the vulnerability is properly addressed and reduces the risk of exploitation.
You can find more information about this vulnerability in the advisory database of the Python Package Index (PyPI). The source link provided in the vulnerability details section of this report points to the relevant entry in the advisory database.
Related vulnerabilities
Recent vulnerabilities recorded for horizon.
