PT-2020-16561 · Openstack · Horizon+1
Lukas Euler
·
Published
2020-10-16
·
Updated
2020-10-27
·
CVE-2020-26943
CVSS v3.1
9.9
Critical
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
OpenStack blazar-dashboard versions prior to 1.3.1
OpenStack blazar-dashboard version 2.0.0
OpenStack blazar-dashboard version 3.0.0
Description
An issue in OpenStack blazar-dashboard allows a user with access to the Blazar dashboard in Horizon to trigger code execution on the Horizon host. This is due to the use of the Python
eval function, which may result in unauthorized access to the Horizon host and further compromise of the Horizon service. All setups using the Horizon dashboard with the blazar-dashboard plugin are affected.Recommendations
For OpenStack blazar-dashboard versions prior to 1.3.1, update to version 1.3.1 or later.
For OpenStack blazar-dashboard version 2.0.0, update to a version later than 2.0.0.
For OpenStack blazar-dashboard version 3.0.0, update to a version later than 3.0.0.
As a temporary workaround, consider restricting access to the Blazar dashboard in Horizon to minimize the risk of exploitation.
Fix
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Horizon
Openstack Blazar-Dashboard