Date: Thu, 14 May 2015 17:31:41 -0400 (EDT) From: cve-assign@...re.org To: tristan.cacqueray@...vance.com Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: CVE request for vulnerability in OpenStack Horizon -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > Title: Persistent XSS in Horizon metadata dashboard > Affects: version 2015.1.0 > a persistent XSS in > Horizon. An authenticated user may conduct a persistent XSS attack by > setting a malicious metadata to a Glance image, a Nova flavor or a Host > Aggregate and tricking an administrator to load the update metadata > page. Once executed in a legitimate context this attack may result in a > privilege escalation. > > https://launchpad.net/bugs/1449260 We are assigning only one CVE ID for this. Use CVE-2015-3988. It appears that 1449260 became a public security bug on 2015-05-01 in https://bugs.launchpad.net/horizon/+bug/1449260/comments/6 and then an additional attack vector (Host Aggregates) was first mentioned in https://bugs.launchpad.net/horizon/+bug/1449260/comments/10 on 2015-05-04. However, there would apparently be no reasonable way to independently address only the attack vectors that were identified earlier. Also, apparently the completely general description of vectors came in from IBM (e.g., "all the other things that have metadata" in https://bugs.launchpad.net/horizon/+bug/1449260/comments/9 on 2015-05-04). Accordingly, it doesn't appear that an additional CVE ID could be useful to anyone. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEbBAEBAgAGBQJVVRPAAAoJEKllVAevmvmsHP4H+KZ48Z7iwRixSwry6qAWuSw9 IW7TpU8mFfqxXyBSq4FQnILX6LReqcUnsehRVnxW4yWIOLlgiyD722ec67gVScbN yUwrW/MPOh2ka0RBfva1YWJIyJ8qzMXgLNBlZD/aLmSpI+bSuLI4tXH0r2pxKto+ 3tbXM8nCRLPcBtRkDJ5QloKBGE8Nkhd3CfKuIsfqHBTOtjBXisd6DbkNnRUULT5i RuzzeVaugkZWZa91etRu7qCsTxD9k5N5F5rcPTbr7A1WO6Yu9Ro73pEkJ5bxDCfd zTCpOMGbjhuhDD0LlggNVIHOxDOQsxt8L51h40D6+8bEZm7MhbUAZ0psYf9U1w== =+K3/ -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.