PT-2020-16561 · Openstack · Horizon+1

Lukas Euler

·

Published

2020-10-16

·

Updated

2020-10-27

·

CVE-2020-26943

CVSS v3.1

9.9

Critical

VectorAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions OpenStack blazar-dashboard versions prior to 1.3.1 OpenStack blazar-dashboard version 2.0.0 OpenStack blazar-dashboard version 3.0.0
Description An issue in OpenStack blazar-dashboard allows a user with access to the Blazar dashboard in Horizon to trigger code execution on the Horizon host. This is due to the use of the Python eval function, which may result in unauthorized access to the Horizon host and further compromise of the Horizon service. All setups using the Horizon dashboard with the blazar-dashboard plugin are affected.
Recommendations For OpenStack blazar-dashboard versions prior to 1.3.1, update to version 1.3.1 or later. For OpenStack blazar-dashboard version 2.0.0, update to a version later than 2.0.0. For OpenStack blazar-dashboard version 3.0.0, update to a version later than 3.0.0. As a temporary workaround, consider restricting access to the Blazar dashboard in Horizon to minimize the risk of exploitation.

Fix

Code Injection

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

CVE-2020-26943
GHSA-939M-4XPW-V34V
PYSEC-2020-225

Affected Products

Horizon
Openstack Blazar-Dashboard