Описание
Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.
A DOM-based, cross-site scripting vulnerability has been identified in the OpenStack dashboard, where user input was not filtered correctly. An authenticated dashboard user could exploit the flaw by injecting an AngularJS template into a dashboard form (for example, using an image's description), triggering the vulnerability when another user browsed the affected page. As a result, this flaw could result in user accounts being compromised (for example, user-access credentials being stolen).
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat OpenStack Platform 10 (Newton) | python-django-horizon | Not affected | ||
| Red Hat OpenStack Platform 9 (Mitaka) | python-django-horizon | Not affected | ||
| Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6 | python-django-horizon | Fixed | RHSA-2016:1268 | 21.06.2016 |
| Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7 | python-django-horizon | Fixed | RHSA-2016:1269 | 21.06.2016 |
| Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7 | python-django-horizon | Fixed | RHSA-2016:1271 | 21.06.2016 |
| Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 | python-django-horizon | Fixed | RHSA-2016:1272 | 21.06.2016 |
| Red Hat OpenStack Platform 8.0 (Liberty) | python-django-horizon | Fixed | RHSA-2016:1270 | 21.06.2016 |
Показывать по
Дополнительная информация
Статус:
4.9 Medium
CVSS2
Связанные уязвимости
Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.
Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.
Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horiz ...
OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability
4.9 Medium
CVSS2