CVE-2021-3654

6.1MEDIUM

Key Information

Vendor
Openstack
Status
Openstack-nova
Vendor
CVE Published:
2 March 2022

Summary

A vulnerability was found in openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL.

Affected Version(s)

openstack-nova = Affects - Nova: <21.2.3, >=22.0.0 <22.2.3, >=23.0.0 <23.0.3 | Fixed-In 21.2.3, 22.3.0, and 23.1.0

References

https://security.openstack.org/ossa/OSSA-2021-002.html
https://bugs.launchpad.net/nova/+bug/1927677
https://www.openwall.com/lists/oss-security/2021/07/29/2

EPSS Score

67% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database
.