PT-2013-6149 · Openstack · Openstack Dashboard

Chris Chapman · Publicado 2013-11-23 · Atualizado 2021-03-09 · CVE-2013-6858

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Dashboard (Horizon) versions 2013.2 and earlier

Description The issue allows local users to inject arbitrary web script or HTML via an instance name to the "Volumes" or "Network Topology" page, which can lead to cross-site scripting (XSS) attacks.

Recommendations For OpenStack Dashboard (Horizon) versions 2013.2 and earlier, update to a version later than 2013.2 to resolve the issue.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2013-6858

RHSA-2014:0365

Produtos afetados

Openstack Dashboard

Referências · 10

• http://secunia.com/advisories/55770 · Nota
• https://security-tracker.debian.org/tracker/CVE-2013-6858 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2013-6858 · Aviso do Fabricante
• http://secunia.com/advisories/56117 · Nota
• http://securityfocus.com/bid/63787 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-6858 · Nota de Segurança
• http://lists.opensuse.org/opensuse-updates/2015-01/msg00040.html · Aviso do Fabricante
• https://bugs.launchpad.net/horizon/+bug/1247675 · Correção
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-6858 · Aviso do Fabricante
• http://ubuntu.com/usn/USN-2062-1 · Aviso do Fabricante