CVE-2012-5474

MediumCVSS 5.5/10Last modified Jun 16, 2026

Description

The file /etc/openstack-dashboard/local_settings within Red Hat OpenStack Platform 2.0 and RHOS Essex Release (python-django-horizon package before 2012.1.1) is world readable and exposes the secret key value.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-311

Affected software

Vendor	Product	Versions
python-django-horizon	python-django-horizon	before 2012.1.1

References

http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092841.htmlThird Party Advisory
https://access.redhat.com/security/cve/cve-2012-5474Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-5474Exploit, Issue Tracking, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2012-5474Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092841.htmlThird Party Advisory
https://access.redhat.com/security/cve/cve-2012-5474Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-5474Exploit, Issue Tracking, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2012-5474Third Party Advisory

Timeline

Published: Dec 30, 2019
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2012

CVE-2012-54765.5Within the RHOS Essex Preview (2012.2) of the OpenStack dashboard package, the file /etc/quantum/quantum.conf is world readable which expose CVE-2012-54773.6The smart proxy in Foreman before 1.1 uses a umask set to 0, which allows local users to modify files created by the daemon via unspecified CVE-2012-54784.9The AuthorizationInterceptor in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform bef CVE-2012-54796.5The Portfolio plugin in Moodle 2.1.x before 2.1.9, 2.2.x before 2.2.6, and 2.3.x before 2.3.3 allows remote authenticated users to upload an CVE-2012-54806.4The Database activity module in Moodle 2.1.x before 2.1.9, 2.2.x before 2.2.6, and 2.3.x before 2.3.3 allows remote attackers to bypass inte CVE-2012-54814.0Moodle 2.3.x before 2.3.3 allows remote authenticated users to bypass the moodle/role:manage capability requirement and read all capability CVE-2012-54825.5The v2 API in OpenStack Glance Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to delete arbitrary non-protec CVE-2012-54832.1tools/sample_data.sh in OpenStack Keystone 2012.1.3, when access to Amazon Elastic Compute Cloud (Amazon EC2) is configured, uses world-read CVE-2012-54847.9The client in FreeIPA 2.x and 3.x before 3.1.2 does not properly obtain the Certification Authority (CA) certificate from the server, which CVE-2012-54856.8registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, rel CVE-2012-54866.4ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrar CVE-2012-54878.5The sandbox whitelisting function (allowmodule.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certai