[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 14 May 2015 17:31:41 -0400 (EDT)
From: cve-assign@...re.org
To: tristan.cacqueray@...vance.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE request for vulnerability in OpenStack Horizon
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> Title: Persistent XSS in Horizon metadata dashboard
> Affects: version 2015.1.0
> a persistent XSS in
> Horizon. An authenticated user may conduct a persistent XSS attack by
> setting a malicious metadata to a Glance image, a Nova flavor or a Host
> Aggregate and tricking an administrator to load the update metadata
> page. Once executed in a legitimate context this attack may result in a
> privilege escalation.
>
> https://launchpad.net/bugs/1449260
We are assigning only one CVE ID for this. Use CVE-2015-3988.
It appears that 1449260 became a public security bug on 2015-05-01 in
https://bugs.launchpad.net/horizon/+bug/1449260/comments/6 and then an
additional attack vector (Host Aggregates) was first mentioned in
https://bugs.launchpad.net/horizon/+bug/1449260/comments/10 on
2015-05-04. However, there would apparently be no reasonable way to
independently address only the attack vectors that were identified
earlier. Also, apparently the completely general description of
vectors came in from IBM (e.g., "all the other things that have
metadata" in
https://bugs.launchpad.net/horizon/+bug/1449260/comments/9 on
2015-05-04). Accordingly, it doesn't appear that an additional CVE ID
could be useful to anyone.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEbBAEBAgAGBQJVVRPAAAoJEKllVAevmvmsHP4H+KZ48Z7iwRixSwry6qAWuSw9
IW7TpU8mFfqxXyBSq4FQnILX6LReqcUnsehRVnxW4yWIOLlgiyD722ec67gVScbN
yUwrW/MPOh2ka0RBfva1YWJIyJ8qzMXgLNBlZD/aLmSpI+bSuLI4tXH0r2pxKto+
3tbXM8nCRLPcBtRkDJ5QloKBGE8Nkhd3CfKuIsfqHBTOtjBXisd6DbkNnRUULT5i
RuzzeVaugkZWZa91etRu7qCsTxD9k5N5F5rcPTbr7A1WO6Yu9Ro73pEkJ5bxDCfd
zTCpOMGbjhuhDD0LlggNVIHOxDOQsxt8L51h40D6+8bEZm7MhbUAZ0psYf9U1w==
=+K3/
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
