PT-2017-8987 · Openstack · Openstack Manila

Martin Prpič + 1 · Publicado 2016-10-05 · Atualizado 2022-05-13 · CVE-2016-6519

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Openstack Manila versions prior to 2.5.1

Description A cross-site scripting (XSS) issue exists in the Shares overview of Openstack Manila, allowing remote authenticated users to inject arbitrary web script or HTML via the Metadata field in the "Create Share" form.

Recommendations For versions prior to 2.5.1, update to version 2.5.1 or later to resolve the issue.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2016-6519

GHSA-VQ76-5GHR-9P4V

RHSA-2016:2115

RHSA-2016:2116

RHSA-2016:2117

SUSE-SU-2016:2457-1

Produtos afetados

Openstack Manila

Referências · 23

• https://github.com/openstack/manila-ui/commit/fca19a1b0d42536644212c5d673fbd6866e67c43 · Nota
• https://github.com/openstack/manila-ui/commit/89593686ef18f2bd06223b92071b4be2362a5abd · Nota
• https://github.com/openstack/manila-ui/commit/009913d725bee34cef0bd62e47a298025ace2696 · Nota
• https://github.com/openstack/manila-ui/blob/d5fe23e4ba30846acdd09fa1dc61a415016a7e26/manila_ui/dashboards/project/shares/shares/tabs.py#L49 · Nota
• https://bugzilla.suse.com/988935 · Nota
• https://ubuntu.com/security/CVE-2016-6519 · Aviso do Fabricante
• https://suse.com/support/update/announcement/2016/suse-su-20162457-1 · Nota
• http://rhn.redhat.com/errata/RHSA-2016-2117.html · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=1375147 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-6519 · Nota de Segurança
• http://rhn.redhat.com/errata/RHSA-2016-2116.html · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2016-6519 · Nota
• https://osv.dev/vulnerability/CVE-2016-6519 · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2016-2115.html · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-6519 · Aviso do Fabricante