Session Hijacking

2019-01-1509:05:27

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.007 Low

EPSS

Percentile

80.1%

JSON

openstack-nova is vulnerable to session hijacking attacks. The vulnerability exists as OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the authentication of users for access to consoles via a crafted webpage.

CPENameOperatorVersion
openstack-novaeq15.1.5__1.el7
openstack-novaeq2013.2.4__2.el6ost
openstack-novaeq2013.2__10.el6ost
openstack-novaeq16.1.4__2.el7
openstack-novaeq2013.1.1__2.el6ost
openstack-novaeq2014.1.1__3.el6ost
openstack-novaeq17.0.3__1.el7
openstack-novaeq2014.1.1__4.el7ost
openstack-novaeq17.0.2__1.el7
openstack-novaeq2012.1.1__15.el6

Name	Operator	Version
openstack-nova	eq	15.1.5__1.el7
openstack-nova	eq	2013.2.4__2.el6ost
openstack-nova	eq	2013.2__10.el6ost
openstack-nova	eq	16.1.4__2.el7
openstack-nova	eq	2013.1.1__2.el6ost
openstack-nova	eq	2014.1.1__3.el6ost
openstack-nova	eq	17.0.3__1.el7
openstack-nova	eq	2014.1.1__4.el7ost
openstack-nova	eq	17.0.2__1.el7
openstack-nova	eq	2012.1.1__15.el6