Cross-Site Scripting Vulnerability in OpenStack Horizon by OpenStack
CVE-2017-7400

4.8MEDIUM

Key Information:

Vendor
Openstack
Status
Horizon
Vendor
CVE Published:
3 April 2017

Summary

OpenStack Horizon versions 9.x up to 9.1.1, 10.x up to 10.0.2, and 11.0.0 are susceptible to a Cross-Site Scripting (XSS) vulnerability. This allows remote authenticated administrators to carry out XSS attacks by submitting specifically crafted federation mappings. These attacks could lead to unauthorized actions and the exposure of sensitive information, posing a significant security risk. It is advisable for users of affected versions to implement mitigation strategies and apply updates promptly.

References

http://www.securityfocus.com/bid/97324
vdb-entryx_refsource_BID
https://launchpad.net/bugs/1667086
x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2017:1598
vendor-advisoryx_refsource_REDHAT

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.