PT-2012-3803 · Openstack · Openstack Dashboard

Matthias Weckbecker · Published 2012-06-05 · Updated 2022-05-17 · CVE-2012-2094

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Dashboard (Horizon) versions folsom-1 and 2012.1 and earlier

Description The issue is related to a cross-site scripting (XSS) vulnerability in the refresh mechanism of the log viewer. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the guest console. The vulnerability is located in the horizon/static/horizon/js/horizon.js file.

Recommendations For OpenStack Dashboard (Horizon) versions folsom-1 and 2012.1 and earlier, consider disabling the log viewer refresh mechanism until a patch is available. Restrict access to the guest console to minimize the risk of exploitation. Avoid using the guest console in the log viewer until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2012-2094

GHSA-J772-HPMW-32RM

PYSEC-2012-32

Affected Products

Openstack Dashboard

References · 18

• http://secunia.com/advisories/49024 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2012-32 · Vendor Advisory
• http://secunia.com/advisories/49071 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j772-hpmw-32rm · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-2094 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-2094 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079160.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-2094 · Vendor Advisory
• http://ubuntu.com/usn/usn-1439-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-2094 · Vendor Advisory
• https://github.com/openstack/horizon/commit/7f8c788aa70db98ac904f37fa4197fcabb802942 · Note
• https://github.com/openstack/horizon/commit/ab2e27522aaeb0268fcc121bd3eff5a4485f313c · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/horizon/PYSEC-2012-32.yaml · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/76136 · Note
• https://github.com/advisories/GHSA-j772-hpmw-32rm · Note