PT-2017-17709 · Openstack · Openstack Horizon

Eric Brown · Published 2017-04-03 · Updated 2022-05-14 · CVE-2017-7400

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Horizon versions 9.x through 9.1.1 OpenStack Horizon versions 10.x through 10.0.2 OpenStack Horizon version 11.0.0

Description The issue allows remote authenticated administrators to conduct cross-site scripting (XSS) attacks by using a crafted federation mapping.

Recommendations For versions 9.x through 9.1.1, update to a version later than 9.1.1 to resolve the issue. For versions 10.x through 10.0.2, update to a version later than 10.0.2 to resolve the issue. For version 11.0.0, update to a version later than 11.0.0 to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-7400

GHSA-47VP-44V9-RHGQ

RHSA-2017:1598

RHSA-2017:1739

SUSE-SU-2017:1443-1

Affected Products

Openstack Horizon

References · 23

• https://nvd.nist.gov/vuln/detail/CVE-2017-7400 · Security Note
• https://access.redhat.com/errata/RHSA-2017:1598 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-7400 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:1739 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-7400 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-7400 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-47vp-44v9-rhgq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-7400 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-7400 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:1443-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-7400 · Security Note
• https://opendev.org/openstack/horizon/commit/511b325b45b6bd7a88bb6df1a4639b80d0121277 · Note
• https://launchpad.net/bugs/1667086 · Note
• https://bugzilla.suse.com/1032322 · Note
• https://suse.com/security/cve/CVE-2017-7400 · Note