PT-2012-3803 · Openstack · Openstack Dashboard

Matthias Weckbecker · Publicado 2012-06-05 · Atualizado 2022-05-17 · CVE-2012-2094

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Dashboard (Horizon) versions folsom-1 and 2012.1 and earlier

Description The issue is related to a cross-site scripting (XSS) vulnerability in the refresh mechanism of the log viewer. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the guest console. The vulnerability is located in the horizon/static/horizon/js/horizon.js file.

Recommendations For OpenStack Dashboard (Horizon) versions folsom-1 and 2012.1 and earlier, consider disabling the log viewer refresh mechanism until a patch is available. Restrict access to the guest console to minimize the risk of exploitation. Avoid using the guest console in the log viewer until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2012-2094

GHSA-J772-HPMW-32RM

PYSEC-2012-32

Produtos afetados

Openstack Dashboard

Referências · 18

• https://github.com/openstack/horizon/commit/7f8c788aa70db98ac904f37fa4197fcabb802942 · Nota
• https://github.com/openstack/horizon/commit/ab2e27522aaeb0268fcc121bd3eff5a4485f313c · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/horizon/PYSEC-2012-32.yaml · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/76136 · Nota
• http://secunia.com/advisories/49024 · Aviso do Fabricante
• https://github.com/advisories/GHSA-j772-hpmw-32rm · Nota
• https://osv.dev/vulnerability/PYSEC-2012-32 · Aviso do Fabricante
• http://secunia.com/advisories/49071 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-j772-hpmw-32rm · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-2094 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-2094 · Nota de Segurança
• http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079160.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2012-2094 · Aviso do Fabricante
• http://ubuntu.com/usn/usn-1439-1 · Aviso do Fabricante
• https://lists.launchpad.net/openstack/msg10211.html · Nota