PT-2012-6308 · Openstack · Openstack Dashboard

Publicado 2012-06-05 · Atualizado 2012-06-05

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions OpenStack Dashboard (Horizon) versions folsom-1 and 2012.1 and earlier

Description A cross-site scripting (XSS) issue exists in the log viewer's refresh mechanism, allowing remote attackers to inject arbitrary web script or HTML via the guest console. This affects the horizon.js file located in horizon/static/horizon/js/.

Recommendations For OpenStack Dashboard (Horizon) versions folsom-1 and 2012.1 and earlier, consider disabling the log viewer's refresh mechanism in the horizon.js file until a patch is available. Restrict access to the guest console to minimize the risk of exploitation.

Identificadores relacionados

PYSEC-2012-32

Produtos afetados

Openstack Dashboard

Referências · 10

• https://github.com/openstack/horizon/commit/7f8c788aa70db98ac904f37fa4197fcabb802942 · Nota
• http://secunia.com/advisories/49071 · Nota
• https://lists.launchpad.net/openstack/msg10211.html · Nota
• http://osvdb.org/81742 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079160.html · Nota
• https://bugs.launchpad.net/horizon/+bug/977944 · Nota
• https://osv.dev/vulnerability/PYSEC-2012-32 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/76136 · Nota
• http://secunia.com/advisories/49024 · Nota
• http://ubuntu.com/usn/usn-1439-1 · Nota