PT-2012-6308 · Openstack · Openstack Dashboard

Published 2012-06-05 · Updated 2012-06-05

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions OpenStack Dashboard (Horizon) versions folsom-1 and 2012.1 and earlier

Description A cross-site scripting (XSS) issue exists in the log viewer's refresh mechanism, allowing remote attackers to inject arbitrary web script or HTML via the guest console. This affects the horizon.js file located in horizon/static/horizon/js/.

Recommendations For OpenStack Dashboard (Horizon) versions folsom-1 and 2012.1 and earlier, consider disabling the log viewer's refresh mechanism in the horizon.js file until a patch is available. Restrict access to the guest console to minimize the risk of exploitation.

Related Identifiers

PYSEC-2012-32

Affected Products

Openstack Dashboard

References · 10

• https://osv.dev/vulnerability/PYSEC-2012-32 · Vendor Advisory
• https://github.com/openstack/horizon/commit/7f8c788aa70db98ac904f37fa4197fcabb802942 · Note
• http://secunia.com/advisories/49071 · Note
• https://lists.launchpad.net/openstack/msg10211.html · Note
• http://osvdb.org/81742 · Note
• http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079160.html · Note
• https://bugs.launchpad.net/horizon/+bug/977944 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/76136 · Note
• http://secunia.com/advisories/49024 · Note
• http://ubuntu.com/usn/usn-1439-1 · Note