PT-2017-17709 · Openstack · Openstack Horizon

Eric Brown · Publicado 2017-04-03 · Atualizado 2022-05-14 · CVE-2017-7400

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Horizon versions 9.x through 9.1.1 OpenStack Horizon versions 10.x through 10.0.2 OpenStack Horizon version 11.0.0

Description The issue allows remote authenticated administrators to conduct cross-site scripting (XSS) attacks by using a crafted federation mapping.

Recommendations For versions 9.x through 9.1.1, update to a version later than 9.1.1 to resolve the issue. For versions 10.x through 10.0.2, update to a version later than 10.0.2 to resolve the issue. For version 11.0.0, update to a version later than 11.0.0 to resolve the issue.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-7400

GHSA-47VP-44V9-RHGQ

RHSA-2017:1598

RHSA-2017:1739

SUSE-SU-2017:1443-1

Produtos afetados

Openstack Horizon

Referências · 23

• https://opendev.org/openstack/horizon/commit/511b325b45b6bd7a88bb6df1a4639b80d0121277 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-7400 · Nota de Segurança
• https://launchpad.net/bugs/1667086 · Nota
• https://access.redhat.com/errata/RHSA-2017:1598 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-7400 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2017:1739 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-7400 · Aviso do Fabricante
• https://bugzilla.suse.com/1032322 · Nota
• https://security-tracker.debian.org/tracker/CVE-2017-7400 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2017-7400 · Nota
• https://osv.dev/vulnerability/GHSA-47vp-44v9-rhgq · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-7400 · Aviso do Fabricante
• https://suse.com/support/update/announcement/2017/suse-su-20171443-1 · Nota
• https://bugzilla.suse.com/1024328 · Nota
• https://opendev.org/openstack/horizon/commit/a835dbfbaa2c70329c08d4b8429d49315dc6d651 · Nota