PT-2023-14709 · Unknown · Horizon Web Dashboard

Phan Nguyên Long · Publicado 2023-08-22 · Atualizado 2023-12-01 · CVE-2022-45582

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Horizon Web Dashboard versions 19.4.0 through 20.1.4

Description The issue is related to an Open Redirect vulnerability via the success url parameter. This allows for potential redirection to unintended websites.

Recommendations For Horizon Web Dashboard versions 19.4.0 through 20.1.4, consider restricting access to the success url parameter to minimize the risk of exploitation. As a temporary workaround, avoid using the success url parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Enumeração de Fraquezas

CWE-601

Identificadores relacionados

CVE-2022-45582

DLA-3678-1

GHSA-5PV6-RPRW-82WV

PYSEC-2023-153

Produtos afetados

Horizon Web Dashboard

Referências · 20

• https://github.com/openstack/horizon · Nota
• https://github.com/openstack/horizon/blob/master/horizon/workflows/views.py#L96-L102 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/horizon/PYSEC-2023-153.yaml · Nota
• https://osv.dev/vulnerability/PYSEC-2023-153 · Aviso do Fabricante
• https://t.me/cvenotify/61843 · Publicação no Telegram
• https://t.me/cvenotify/61814 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-45582 · Nota de Segurança
• https://opendev.org/openstack/horizon/commit/79d139594290779b2f74ca894332aa7f2f7e4735 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-45582 · Aviso do Fabricante
• https://bugs.launchpad.net/horizon/+bug/1982676 · Aviso do Fabricante
• https://osv.dev/vulnerability/DLA-3678-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-5pv6-rprw-82wv · Aviso do Fabricante
• https://lists.debian.org/debian-lts-announce/2023/11/msg00033.html · Nota
• https://cve.org/CVERecord?id=CVE-2022-45582 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-45582 · Aviso do Fabricante