(RHSA-2016:2117) Moderate: openstack-manila-ui security update

OpenStack’s File Share Service (manila) provides the means to easily provision shared file systems that can be consumed by multiple instances. These shared file systems are provisioned from pre-existing, back-end volumes. The UI component provides the dashboard plugin for the service.

Security Fix(es):

• A cross-site scripting flaw was discovered in openstack-manila-ui’s Metadata field contained in its “Create Share” form. A user could inject malicious HTML/JavaScript code that would then be reflected in the “Shares” overview. Remote, authenticated, but unprivileged users could exploit this vulnerability to steal session cookies and escalate their privileges. (CVE-2016-6519)

Red Hat would like to thank SUSE for reporting this issue. SUSE acknowledges Niklaus Schiess as the original reporter.