OpenStack Horizon vulnerability

2012-09-1300:00:00

ubuntu.com

5.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

6.3 Medium

AI Score

Confidence

Low

0.008 Low

EPSS

Percentile

81.6%

JSON

Releases

Ubuntu 12.04

Packages

horizon - Web interface for OpenStack cloud infrastructure

Details

Thomas Biege discovered that the Horizon authentication mechanism
did not validate the next parameter. An attacker could use this to
construct a link to legitimate OpenStack web dashboard that redirected
the user to a malicious website after authentication.

OSVersionArchitecturePackageVersionFilename
Ubuntu12.04noarchopenstack-dashboard< 2012.1.3+stable~20120815-691dd2-0ubuntu1.1UNKNOWN
Ubuntu12.04noarchopenstack-dashboard-ubuntu-theme< 2012.1.3+stable~20120815-691dd2-0ubuntu1.1UNKNOWN
Ubuntu12.04noarchpython-django-horizon< 2012.1.3+stable~20120815-691dd2-0ubuntu1.1UNKNOWN
Ubuntu12.04noarchpython-django-openstack< 2012.1.3+stable~20120815-691dd2-0ubuntu1.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	12.04	noarch	openstack-dashboard	< 2012.1.3+stable~20120815-691dd2-0ubuntu1.1	UNKNOWN
Ubuntu	12.04	noarch	openstack-dashboard-ubuntu-theme	< 2012.1.3+stable~20120815-691dd2-0ubuntu1.1	UNKNOWN
Ubuntu	12.04	noarch	python-django-horizon	< 2012.1.3+stable~20120815-691dd2-0ubuntu1.1	UNKNOWN
Ubuntu	12.04	noarch	python-django-openstack	< 2012.1.3+stable~20120815-691dd2-0ubuntu1.1	UNKNOWN