PT-2023-14709 · Unknown · Horizon Web Dashboard

Phan Nguyên Long · Published 2023-08-22 · Updated 2023-12-01 · CVE-2022-45582

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Horizon Web Dashboard versions 19.4.0 through 20.1.4

Description The issue is related to an Open Redirect vulnerability via the success url parameter. This allows for potential redirection to unintended websites.

Recommendations For Horizon Web Dashboard versions 19.4.0 through 20.1.4, consider restricting access to the success url parameter to minimize the risk of exploitation. As a temporary workaround, avoid using the success url parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2022-45582

DLA-3678-1

GHSA-5PV6-RPRW-82WV

PYSEC-2023-153

Affected Products

Horizon Web Dashboard

References · 20

• https://osv.dev/vulnerability/PYSEC-2023-153 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45582 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-45582 · Vendor Advisory
• https://bugs.launchpad.net/horizon/+bug/1982676 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3678-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5pv6-rprw-82wv · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-45582 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-45582 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-45582 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-45582 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-45582 · Vendor Advisory
• https://github.com/openstack/horizon · Note
• https://github.com/openstack/horizon/blob/master/horizon/workflows/views.py#L96-L102 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/horizon/PYSEC-2023-153.yaml · Note
• https://t.me/cvenotify/61843 · Telegram Post