CRITICAL🇬🇧 English

CVE-2020-26943

CVSS 9.9v3.1pub. 2020-10-16upd. 2024-11-21

An issue was discovered in OpenStack blazar-dashboard before 1.3.1, 2.0.0, and 3.0.0. A user allowed to access the Blazar dashboard in Horizon may trigger code execution on the Horizon host as the user the Horizon service runs under (because the Python eval function is used). This may result in Horizon host unauthorized access and further compromise of the Horizon service. All setups using the Horizon dashboard with the blazar-dashboard plugin are affected.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

  • Openstack Blazar Dashboard

    APP
    Openstack
    2.0.03.0.0< 1.3.1
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
RCE
CWE
Referencje

Powiązane podatności

CVE-2026-28370CRITICAL9.1PL ✓ten sam vendor

RCE w OpenStack Vitrage — wykonanie kodu przez parser zapytań API

CVE-2024-28718CRITICAL9.8PL ✓ten sam vendor

RCE w OpenStack Magnum — podatność w komponencie cert_manager.py

CVE-2021-38598CRITICAL9.1ten sam vendor

OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the...

CVE-2013-2166CRITICAL9.8ten sam vendor

python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache encryption bypass

CVE-2013-2167CRITICAL9.8ten sam vendor

python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache signing bypass