PT-2017-8987 · Openstack · Openstack Manila

Martin Prpič + 1 · Published 2016-10-05 · Updated 2022-05-13 · CVE-2016-6519

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Openstack Manila versions prior to 2.5.1

Description A cross-site scripting (XSS) issue exists in the Shares overview of Openstack Manila, allowing remote authenticated users to inject arbitrary web script or HTML via the Metadata field in the "Create Share" form.

Recommendations For versions prior to 2.5.1, update to version 2.5.1 or later to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2016-6519

GHSA-VQ76-5GHR-9P4V

RHSA-2016:2115

RHSA-2016:2116

RHSA-2016:2117

SUSE-SU-2016:2457-1

Affected Products

Openstack Manila

References · 23

• https://ubuntu.com/security/CVE-2016-6519 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2016-2117.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-6519 · Security Note
• http://rhn.redhat.com/errata/RHSA-2016-2116.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-6519 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2016-2115.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-6519 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-6519 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2016-6519 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vq76-5ghr-9p4v · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:2457-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-6519 · Vendor Advisory
• https://github.com/openstack/manila-ui/commit/fca19a1b0d42536644212c5d673fbd6866e67c43 · Note
• https://github.com/openstack/manila-ui/commit/89593686ef18f2bd06223b92071b4be2362a5abd · Note
• https://github.com/openstack/manila-ui/commit/009913d725bee34cef0bd62e47a298025ace2696 · Note