Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2020-29565 (GCVE-0-2020-29565)
Vulnerability from cvelistv5
Published
2020-12-04 07:06
Modified
2024-08-04 16:55
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the "next" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL.
References
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-04T16:55:10.412Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://bugs.launchpad.net/horizon/+bug/1865026" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://review.opendev.org/c/openstack/horizon/+/758841/" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://review.opendev.org/c/openstack/horizon/+/758843/" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://security.openstack.org/ossa/OSSA-2020-008.html" }, { "name": "[oss-security] 20201207 [OSSA-2020-008] horizon: Open redirect in workflow forms (CVE-2020-29565)", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2020/12/08/2" }, { "name": "DSA-4820", "tags": [ "vendor-advisory", "x_refsource_DEBIAN", "x_transferred" ], "url": "https://www.debian.org/security/2020/dsa-4820" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "descriptions": [ { "lang": "en", "value": "An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the \"next\" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL." } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2020-12-28T16:06:10", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://bugs.launchpad.net/horizon/+bug/1865026" }, { "tags": [ "x_refsource_MISC" ], "url": "https://review.opendev.org/c/openstack/horizon/+/758841/" }, { "tags": [ "x_refsource_MISC" ], "url": "https://review.opendev.org/c/openstack/horizon/+/758843/" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://security.openstack.org/ossa/OSSA-2020-008.html" }, { "name": "[oss-security] 20201207 [OSSA-2020-008] horizon: Open redirect in workflow forms (CVE-2020-29565)", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "http://www.openwall.com/lists/oss-security/2020/12/08/2" }, { "name": "DSA-4820", "tags": [ "vendor-advisory", "x_refsource_DEBIAN" ], "url": "https://www.debian.org/security/2020/dsa-4820" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2020-29565", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the \"next\" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "https://bugs.launchpad.net/horizon/+bug/1865026", "refsource": "MISC", "url": "https://bugs.launchpad.net/horizon/+bug/1865026" }, { "name": "https://review.opendev.org/c/openstack/horizon/+/758841/", "refsource": "MISC", "url": "https://review.opendev.org/c/openstack/horizon/+/758841/" }, { "name": "https://review.opendev.org/c/openstack/horizon/+/758843/", "refsource": "MISC", "url": "https://review.opendev.org/c/openstack/horizon/+/758843/" }, { "name": "https://security.openstack.org/ossa/OSSA-2020-008.html", "refsource": "CONFIRM", "url": "https://security.openstack.org/ossa/OSSA-2020-008.html" }, { "name": "[oss-security] 20201207 [OSSA-2020-008] horizon: Open redirect in workflow forms (CVE-2020-29565)", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2020/12/08/2" }, { "name": "DSA-4820", "refsource": "DEBIAN", "url": "https://www.debian.org/security/2020/dsa-4820" } ] } } } }, "cveMetadata": { "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2020-29565", "datePublished": "2020-12-04T07:06:03", "dateReserved": "2020-12-04T00:00:00", "dateUpdated": "2024-08-04T16:55:10.412Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2020-29565\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2020-12-04T08:15:11.143\",\"lastModified\":\"2024-11-21T05:24:12.760\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the \\\"next\\\" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL.\"},{\"lang\":\"es\",\"value\":\"Se detect\u00f3 un problema en OpenStack Horizon versiones 15.3.2, versiones 16.x anteriores a 16.2.1, versiones 17.x y versiones 18.x anteriores a 18.3.3, versiones 18.4.x y 18.5.x.\u0026#xa0;Se presenta una falta de comprobaci\u00f3n del par\u00e1metro \\\"next\\\", lo que permitir\u00eda a alguien proporcionar una URL maliciosa en Horizon que puede causar un redireccionamiento autom\u00e1tico a la URL maliciosa proporcionada\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.7}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:P/A:N\",\"baseScore\":5.8,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":4.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-601\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openstack:horizon:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"15.3.0\",\"versionEndExcluding\":\"15.3.2\",\"matchCriteriaId\":\"73CBE2A7-7561-403A-BA84-D72179C49B63\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openstack:horizon:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"16.0.0\",\"versionEndExcluding\":\"16.2.1\",\"matchCriteriaId\":\"A14EB5AB-402A-4485-A46A-1689E6F16AB2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openstack:horizon:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"17.0.0\",\"versionEndExcluding\":\"18.3.3\",\"matchCriteriaId\":\"9B65C2BD-8285-45AE-9C73-35749668B047\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openstack:horizon:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"18.4.0\",\"versionEndIncluding\":\"18.5.0\",\"matchCriteriaId\":\"08C9AD76-3326-499F-B860-D22EC858FD52\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]}],\"references\":[{\"url\":\"http://www.openwall.com/lists/oss-security/2020/12/08/2\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://bugs.launchpad.net/horizon/+bug/1865026\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://review.opendev.org/c/openstack/horizon/+/758841/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://review.opendev.org/c/openstack/horizon/+/758843/\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://security.openstack.org/ossa/OSSA-2020-008.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://www.debian.org/security/2020/dsa-4820\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2020/12/08/2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://bugs.launchpad.net/horizon/+bug/1865026\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://review.opendev.org/c/openstack/horizon/+/758841/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://review.opendev.org/c/openstack/horizon/+/758843/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://security.openstack.org/ossa/OSSA-2020-008.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://www.debian.org/security/2020/dsa-4820\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}" } }
rhsa-2020:5411
Vulnerability from csaf_redhat
Published
2020-12-15 19:04
Modified
2025-09-26 04:57
Summary
Red Hat Security Advisory: python-django-horizon security update
Notes
Topic
An update for python-django-horizon is now available for Red Hat OpenStack
Platform 16.1 (Train).
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
Details
OpenStack Dashboard (horizon) provides administrators and users with a
graphical interface to access, provision, and automate cloud-based
resources.
Security Fix(es):
* dashboard allows open redirect (CVE-2020-29565)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for python-django-horizon is now available for Red Hat OpenStack\nPlatform 16.1 (Train).\n\nRed Hat Product Security has rated this update as having a security impact\nof Moderate. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "OpenStack Dashboard (horizon) provides administrators and users with a\ngraphical interface to access, provision, and automate cloud-based\nresources.\n\nSecurity Fix(es):\n\n* dashboard allows open redirect (CVE-2020-29565)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:5411", "url": "https://access.redhat.com/errata/RHSA-2020:5411" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "1811510", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1811510" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5411.json" } ], "title": "Red Hat Security Advisory: python-django-horizon security update", "tracking": { "current_release_date": "2025-09-26T04:57:03+00:00", "generator": { "date": "2025-09-26T04:57:03+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.8" } }, "id": "RHSA-2020:5411", "initial_release_date": "2020-12-15T19:04:30+00:00", "revision_history": [ { "date": "2020-12-15T19:04:30+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-12-15T19:04:30+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-09-26T04:57:03+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenStack Platform 16.1", "product": { "name": "Red Hat OpenStack Platform 16.1", "product_id": "8Base-RHOS-16.1", "product_identification_helper": { "cpe": "cpe:/a:redhat:openstack:16.1::el8" } } } ], "category": "product_family", "name": "Red Hat OpenStack Platform" }, { "branches": [ { "category": "product_version", "name": "openstack-dashboard-1:16.2.1-1.20201114033610.el8ost.noarch", "product": { "name": "openstack-dashboard-1:16.2.1-1.20201114033610.el8ost.noarch", "product_id": "openstack-dashboard-1:16.2.1-1.20201114033610.el8ost.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/openstack-dashboard@16.2.1-1.20201114033610.el8ost?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "python3-django-horizon-1:16.2.1-1.20201114033610.el8ost.noarch", "product": { "name": "python3-django-horizon-1:16.2.1-1.20201114033610.el8ost.noarch", "product_id": "python3-django-horizon-1:16.2.1-1.20201114033610.el8ost.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/python3-django-horizon@16.2.1-1.20201114033610.el8ost?arch=noarch\u0026epoch=1" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "python-django-horizon-1:16.2.1-1.20201114033610.el8ost.src", "product": { "name": "python-django-horizon-1:16.2.1-1.20201114033610.el8ost.src", "product_id": "python-django-horizon-1:16.2.1-1.20201114033610.el8ost.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/python-django-horizon@16.2.1-1.20201114033610.el8ost?arch=src\u0026epoch=1" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "openstack-dashboard-1:16.2.1-1.20201114033610.el8ost.noarch as a component of Red Hat OpenStack Platform 16.1", "product_id": "8Base-RHOS-16.1:openstack-dashboard-1:16.2.1-1.20201114033610.el8ost.noarch" }, "product_reference": "openstack-dashboard-1:16.2.1-1.20201114033610.el8ost.noarch", "relates_to_product_reference": "8Base-RHOS-16.1" }, { "category": "default_component_of", "full_product_name": { "name": "python-django-horizon-1:16.2.1-1.20201114033610.el8ost.src as a component of Red Hat OpenStack Platform 16.1", "product_id": "8Base-RHOS-16.1:python-django-horizon-1:16.2.1-1.20201114033610.el8ost.src" }, "product_reference": "python-django-horizon-1:16.2.1-1.20201114033610.el8ost.src", "relates_to_product_reference": "8Base-RHOS-16.1" }, { "category": "default_component_of", "full_product_name": { "name": "python3-django-horizon-1:16.2.1-1.20201114033610.el8ost.noarch as a component of Red Hat OpenStack Platform 16.1", "product_id": "8Base-RHOS-16.1:python3-django-horizon-1:16.2.1-1.20201114033610.el8ost.noarch" }, "product_reference": "python3-django-horizon-1:16.2.1-1.20201114033610.el8ost.noarch", "relates_to_product_reference": "8Base-RHOS-16.1" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Pritam Singh" ], "organization": "Red Hat", "summary": "This issue was discovered by Red Hat." } ], "cve": "CVE-2020-29565", "cwe": { "id": "CWE-601", "name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)" }, "discovery_date": "2020-02-27T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1811510" } ], "notes": [ { "category": "description", "text": "A flaw was found in python-django-horizon. The \"next\" parameter is not correctly validated allowing a remote attacker to supply a malicious URL in the dashboard that could cause an automatic redirect to the provided malicious site. The highest threat from this vulnerability is to data confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "python-django-horizon: dashboard allows open redirect", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOS-16.1:openstack-dashboard-1:16.2.1-1.20201114033610.el8ost.noarch", "8Base-RHOS-16.1:python-django-horizon-1:16.2.1-1.20201114033610.el8ost.src", "8Base-RHOS-16.1:python3-django-horizon-1:16.2.1-1.20201114033610.el8ost.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-29565" }, { "category": "external", "summary": "RHBZ#1811510", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1811510" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-29565", "url": "https://www.cve.org/CVERecord?id=CVE-2020-29565" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-29565", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-29565" }, { "category": "external", "summary": "https://www.openwall.com/lists/oss-security/2020/12/08/2", "url": "https://www.openwall.com/lists/oss-security/2020/12/08/2" } ], "release_date": "2020-02-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-12-15T19:04:30+00:00", "details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOS-16.1:openstack-dashboard-1:16.2.1-1.20201114033610.el8ost.noarch", "8Base-RHOS-16.1:python-django-horizon-1:16.2.1-1.20201114033610.el8ost.src", "8Base-RHOS-16.1:python3-django-horizon-1:16.2.1-1.20201114033610.el8ost.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:5411" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "8Base-RHOS-16.1:openstack-dashboard-1:16.2.1-1.20201114033610.el8ost.noarch", "8Base-RHOS-16.1:python-django-horizon-1:16.2.1-1.20201114033610.el8ost.src", "8Base-RHOS-16.1:python3-django-horizon-1:16.2.1-1.20201114033610.el8ost.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-RHOS-16.1:openstack-dashboard-1:16.2.1-1.20201114033610.el8ost.noarch", "8Base-RHOS-16.1:python-django-horizon-1:16.2.1-1.20201114033610.el8ost.src", "8Base-RHOS-16.1:python3-django-horizon-1:16.2.1-1.20201114033610.el8ost.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "python-django-horizon: dashboard allows open redirect" } ] }
rhsa-2020:5572
Vulnerability from csaf_redhat
Published
2020-12-16 13:54
Modified
2025-09-26 04:57
Summary
Red Hat Security Advisory: python-django-horizon security update
Notes
Topic
An update for python-django-horizon is now available for Red Hat OpenStack
Platform 13 (Queens).
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
Details
OpenStack Dashboard (horizon) provides administrators and users with a
graphical interface to access, provision, and automate cloud-based
resources.
Security Fix(es):
* python-django-horizon: dashboard allows open redirect (CVE-2020-29565)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for python-django-horizon is now available for Red Hat OpenStack\nPlatform 13 (Queens).\n\nRed Hat Product Security has rated this update as having a security impact\nof Moderate. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "OpenStack Dashboard (horizon) provides administrators and users with a\ngraphical interface to access, provision, and automate cloud-based\nresources.\n\nSecurity Fix(es):\n\n* python-django-horizon: dashboard allows open redirect (CVE-2020-29565)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:5572", "url": "https://access.redhat.com/errata/RHSA-2020:5572" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "1811510", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1811510" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5572.json" } ], "title": "Red Hat Security Advisory: python-django-horizon security update", "tracking": { "current_release_date": "2025-09-26T04:57:03+00:00", "generator": { "date": "2025-09-26T04:57:03+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.8" } }, "id": "RHSA-2020:5572", "initial_release_date": "2020-12-16T13:54:29+00:00", "revision_history": [ { "date": "2020-12-16T13:54:29+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-12-16T13:54:29+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-09-26T04:57:03+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenStack Platform 13.0", "product": { "name": "Red Hat OpenStack Platform 13.0", "product_id": "7Server-RH7-RHOS-13.0", "product_identification_helper": { "cpe": "cpe:/a:redhat:openstack:13::el7" } } }, { "category": "product_name", "name": "Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server", "product": { "name": "Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server", "product_id": "7Server-7.6.EUS-RH7-RHOS-13.0", "product_identification_helper": { "cpe": "cpe:/a:redhat:openstack:13::el7" } } } ], "category": "product_family", "name": "Red Hat OpenStack Platform" }, { "branches": [ { "category": "product_version", "name": "openstack-dashboard-1:13.0.3-7.el7ost.noarch", "product": { "name": "openstack-dashboard-1:13.0.3-7.el7ost.noarch", "product_id": "openstack-dashboard-1:13.0.3-7.el7ost.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/openstack-dashboard@13.0.3-7.el7ost?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "python-django-horizon-1:13.0.3-7.el7ost.noarch", "product": { "name": "python-django-horizon-1:13.0.3-7.el7ost.noarch", "product_id": "python-django-horizon-1:13.0.3-7.el7ost.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/python-django-horizon@13.0.3-7.el7ost?arch=noarch\u0026epoch=1" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "python-django-horizon-1:13.0.3-7.el7ost.src", "product": { "name": "python-django-horizon-1:13.0.3-7.el7ost.src", "product_id": "python-django-horizon-1:13.0.3-7.el7ost.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/python-django-horizon@13.0.3-7.el7ost?arch=src\u0026epoch=1" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "openstack-dashboard-1:13.0.3-7.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server", "product_id": "7Server-7.6.EUS-RH7-RHOS-13.0:openstack-dashboard-1:13.0.3-7.el7ost.noarch" }, "product_reference": "openstack-dashboard-1:13.0.3-7.el7ost.noarch", "relates_to_product_reference": "7Server-7.6.EUS-RH7-RHOS-13.0" }, { "category": "default_component_of", "full_product_name": { "name": "python-django-horizon-1:13.0.3-7.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server", "product_id": "7Server-7.6.EUS-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.noarch" }, "product_reference": "python-django-horizon-1:13.0.3-7.el7ost.noarch", "relates_to_product_reference": "7Server-7.6.EUS-RH7-RHOS-13.0" }, { "category": "default_component_of", "full_product_name": { "name": "python-django-horizon-1:13.0.3-7.el7ost.src as a component of Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server", "product_id": "7Server-7.6.EUS-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.src" }, "product_reference": "python-django-horizon-1:13.0.3-7.el7ost.src", "relates_to_product_reference": "7Server-7.6.EUS-RH7-RHOS-13.0" }, { "category": "default_component_of", "full_product_name": { "name": "openstack-dashboard-1:13.0.3-7.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0", "product_id": "7Server-RH7-RHOS-13.0:openstack-dashboard-1:13.0.3-7.el7ost.noarch" }, "product_reference": "openstack-dashboard-1:13.0.3-7.el7ost.noarch", "relates_to_product_reference": "7Server-RH7-RHOS-13.0" }, { "category": "default_component_of", "full_product_name": { "name": "python-django-horizon-1:13.0.3-7.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0", "product_id": "7Server-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.noarch" }, "product_reference": "python-django-horizon-1:13.0.3-7.el7ost.noarch", "relates_to_product_reference": "7Server-RH7-RHOS-13.0" }, { "category": "default_component_of", "full_product_name": { "name": "python-django-horizon-1:13.0.3-7.el7ost.src as a component of Red Hat OpenStack Platform 13.0", "product_id": "7Server-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.src" }, "product_reference": "python-django-horizon-1:13.0.3-7.el7ost.src", "relates_to_product_reference": "7Server-RH7-RHOS-13.0" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Pritam Singh" ], "organization": "Red Hat", "summary": "This issue was discovered by Red Hat." } ], "cve": "CVE-2020-29565", "cwe": { "id": "CWE-601", "name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)" }, "discovery_date": "2020-02-27T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1811510" } ], "notes": [ { "category": "description", "text": "A flaw was found in python-django-horizon. The \"next\" parameter is not correctly validated allowing a remote attacker to supply a malicious URL in the dashboard that could cause an automatic redirect to the provided malicious site. The highest threat from this vulnerability is to data confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "python-django-horizon: dashboard allows open redirect", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-7.6.EUS-RH7-RHOS-13.0:openstack-dashboard-1:13.0.3-7.el7ost.noarch", "7Server-7.6.EUS-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.noarch", "7Server-7.6.EUS-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.src", "7Server-RH7-RHOS-13.0:openstack-dashboard-1:13.0.3-7.el7ost.noarch", "7Server-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.noarch", "7Server-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-29565" }, { "category": "external", "summary": "RHBZ#1811510", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1811510" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-29565", "url": "https://www.cve.org/CVERecord?id=CVE-2020-29565" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-29565", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-29565" }, { "category": "external", "summary": "https://www.openwall.com/lists/oss-security/2020/12/08/2", "url": "https://www.openwall.com/lists/oss-security/2020/12/08/2" } ], "release_date": "2020-02-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-12-16T13:54:29+00:00", "details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-7.6.EUS-RH7-RHOS-13.0:openstack-dashboard-1:13.0.3-7.el7ost.noarch", "7Server-7.6.EUS-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.noarch", "7Server-7.6.EUS-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.src", "7Server-RH7-RHOS-13.0:openstack-dashboard-1:13.0.3-7.el7ost.noarch", "7Server-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.noarch", "7Server-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:5572" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "7Server-7.6.EUS-RH7-RHOS-13.0:openstack-dashboard-1:13.0.3-7.el7ost.noarch", "7Server-7.6.EUS-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.noarch", "7Server-7.6.EUS-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.src", "7Server-RH7-RHOS-13.0:openstack-dashboard-1:13.0.3-7.el7ost.noarch", "7Server-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.noarch", "7Server-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.src" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "7Server-7.6.EUS-RH7-RHOS-13.0:openstack-dashboard-1:13.0.3-7.el7ost.noarch", "7Server-7.6.EUS-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.noarch", "7Server-7.6.EUS-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.src", "7Server-RH7-RHOS-13.0:openstack-dashboard-1:13.0.3-7.el7ost.noarch", "7Server-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.noarch", "7Server-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "python-django-horizon: dashboard allows open redirect" } ] }
rhsa-2020_5411
Vulnerability from csaf_redhat
Published
2020-12-15 19:04
Modified
2024-11-15 07:26
Summary
Red Hat Security Advisory: python-django-horizon security update
Notes
Topic
An update for python-django-horizon is now available for Red Hat OpenStack
Platform 16.1 (Train).
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
Details
OpenStack Dashboard (horizon) provides administrators and users with a
graphical interface to access, provision, and automate cloud-based
resources.
Security Fix(es):
* dashboard allows open redirect (CVE-2020-29565)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for python-django-horizon is now available for Red Hat OpenStack\nPlatform 16.1 (Train).\n\nRed Hat Product Security has rated this update as having a security impact\nof Moderate. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "OpenStack Dashboard (horizon) provides administrators and users with a\ngraphical interface to access, provision, and automate cloud-based\nresources.\n\nSecurity Fix(es):\n\n* dashboard allows open redirect (CVE-2020-29565)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:5411", "url": "https://access.redhat.com/errata/RHSA-2020:5411" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "1811510", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1811510" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5411.json" } ], "title": "Red Hat Security Advisory: python-django-horizon security update", "tracking": { "current_release_date": "2024-11-15T07:26:47+00:00", "generator": { "date": "2024-11-15T07:26:47+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2020:5411", "initial_release_date": "2020-12-15T19:04:30+00:00", "revision_history": [ { "date": "2020-12-15T19:04:30+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-12-15T19:04:30+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-15T07:26:47+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenStack Platform 16.1", "product": { "name": "Red Hat OpenStack Platform 16.1", "product_id": "8Base-RHOS-16.1", "product_identification_helper": { "cpe": "cpe:/a:redhat:openstack:16.1::el8" } } } ], "category": "product_family", "name": "Red Hat OpenStack Platform" }, { "branches": [ { "category": "product_version", "name": "openstack-dashboard-1:16.2.1-1.20201114033610.el8ost.noarch", "product": { "name": "openstack-dashboard-1:16.2.1-1.20201114033610.el8ost.noarch", "product_id": "openstack-dashboard-1:16.2.1-1.20201114033610.el8ost.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/openstack-dashboard@16.2.1-1.20201114033610.el8ost?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "python3-django-horizon-1:16.2.1-1.20201114033610.el8ost.noarch", "product": { "name": "python3-django-horizon-1:16.2.1-1.20201114033610.el8ost.noarch", "product_id": "python3-django-horizon-1:16.2.1-1.20201114033610.el8ost.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/python3-django-horizon@16.2.1-1.20201114033610.el8ost?arch=noarch\u0026epoch=1" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "python-django-horizon-1:16.2.1-1.20201114033610.el8ost.src", "product": { "name": "python-django-horizon-1:16.2.1-1.20201114033610.el8ost.src", "product_id": "python-django-horizon-1:16.2.1-1.20201114033610.el8ost.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/python-django-horizon@16.2.1-1.20201114033610.el8ost?arch=src\u0026epoch=1" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "openstack-dashboard-1:16.2.1-1.20201114033610.el8ost.noarch as a component of Red Hat OpenStack Platform 16.1", "product_id": "8Base-RHOS-16.1:openstack-dashboard-1:16.2.1-1.20201114033610.el8ost.noarch" }, "product_reference": "openstack-dashboard-1:16.2.1-1.20201114033610.el8ost.noarch", "relates_to_product_reference": "8Base-RHOS-16.1" }, { "category": "default_component_of", "full_product_name": { "name": "python-django-horizon-1:16.2.1-1.20201114033610.el8ost.src as a component of Red Hat OpenStack Platform 16.1", "product_id": "8Base-RHOS-16.1:python-django-horizon-1:16.2.1-1.20201114033610.el8ost.src" }, "product_reference": "python-django-horizon-1:16.2.1-1.20201114033610.el8ost.src", "relates_to_product_reference": "8Base-RHOS-16.1" }, { "category": "default_component_of", "full_product_name": { "name": "python3-django-horizon-1:16.2.1-1.20201114033610.el8ost.noarch as a component of Red Hat OpenStack Platform 16.1", "product_id": "8Base-RHOS-16.1:python3-django-horizon-1:16.2.1-1.20201114033610.el8ost.noarch" }, "product_reference": "python3-django-horizon-1:16.2.1-1.20201114033610.el8ost.noarch", "relates_to_product_reference": "8Base-RHOS-16.1" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Pritam Singh" ], "organization": "Red Hat", "summary": "This issue was discovered by Red Hat." } ], "cve": "CVE-2020-29565", "cwe": { "id": "CWE-601", "name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)" }, "discovery_date": "2020-02-27T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1811510" } ], "notes": [ { "category": "description", "text": "A flaw was found in python-django-horizon. The \"next\" parameter is not correctly validated allowing a remote attacker to supply a malicious URL in the dashboard that could cause an automatic redirect to the provided malicious site. The highest threat from this vulnerability is to data confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "python-django-horizon: dashboard allows open redirect", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOS-16.1:openstack-dashboard-1:16.2.1-1.20201114033610.el8ost.noarch", "8Base-RHOS-16.1:python-django-horizon-1:16.2.1-1.20201114033610.el8ost.src", "8Base-RHOS-16.1:python3-django-horizon-1:16.2.1-1.20201114033610.el8ost.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-29565" }, { "category": "external", "summary": "RHBZ#1811510", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1811510" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-29565", "url": "https://www.cve.org/CVERecord?id=CVE-2020-29565" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-29565", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-29565" }, { "category": "external", "summary": "https://www.openwall.com/lists/oss-security/2020/12/08/2", "url": "https://www.openwall.com/lists/oss-security/2020/12/08/2" } ], "release_date": "2020-02-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-12-15T19:04:30+00:00", "details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOS-16.1:openstack-dashboard-1:16.2.1-1.20201114033610.el8ost.noarch", "8Base-RHOS-16.1:python-django-horizon-1:16.2.1-1.20201114033610.el8ost.src", "8Base-RHOS-16.1:python3-django-horizon-1:16.2.1-1.20201114033610.el8ost.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:5411" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "8Base-RHOS-16.1:openstack-dashboard-1:16.2.1-1.20201114033610.el8ost.noarch", "8Base-RHOS-16.1:python-django-horizon-1:16.2.1-1.20201114033610.el8ost.src", "8Base-RHOS-16.1:python3-django-horizon-1:16.2.1-1.20201114033610.el8ost.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-RHOS-16.1:openstack-dashboard-1:16.2.1-1.20201114033610.el8ost.noarch", "8Base-RHOS-16.1:python-django-horizon-1:16.2.1-1.20201114033610.el8ost.src", "8Base-RHOS-16.1:python3-django-horizon-1:16.2.1-1.20201114033610.el8ost.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "python-django-horizon: dashboard allows open redirect" } ] }
RHSA-2020:5572
Vulnerability from csaf_redhat
Published
2020-12-16 13:54
Modified
2025-09-26 04:57
Summary
Red Hat Security Advisory: python-django-horizon security update
Notes
Topic
An update for python-django-horizon is now available for Red Hat OpenStack
Platform 13 (Queens).
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
Details
OpenStack Dashboard (horizon) provides administrators and users with a
graphical interface to access, provision, and automate cloud-based
resources.
Security Fix(es):
* python-django-horizon: dashboard allows open redirect (CVE-2020-29565)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for python-django-horizon is now available for Red Hat OpenStack\nPlatform 13 (Queens).\n\nRed Hat Product Security has rated this update as having a security impact\nof Moderate. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "OpenStack Dashboard (horizon) provides administrators and users with a\ngraphical interface to access, provision, and automate cloud-based\nresources.\n\nSecurity Fix(es):\n\n* python-django-horizon: dashboard allows open redirect (CVE-2020-29565)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:5572", "url": "https://access.redhat.com/errata/RHSA-2020:5572" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "1811510", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1811510" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5572.json" } ], "title": "Red Hat Security Advisory: python-django-horizon security update", "tracking": { "current_release_date": "2025-09-26T04:57:03+00:00", "generator": { "date": "2025-09-26T04:57:03+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.8" } }, "id": "RHSA-2020:5572", "initial_release_date": "2020-12-16T13:54:29+00:00", "revision_history": [ { "date": "2020-12-16T13:54:29+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-12-16T13:54:29+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-09-26T04:57:03+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenStack Platform 13.0", "product": { "name": "Red Hat OpenStack Platform 13.0", "product_id": "7Server-RH7-RHOS-13.0", "product_identification_helper": { "cpe": "cpe:/a:redhat:openstack:13::el7" } } }, { "category": "product_name", "name": "Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server", "product": { "name": "Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server", "product_id": "7Server-7.6.EUS-RH7-RHOS-13.0", "product_identification_helper": { "cpe": "cpe:/a:redhat:openstack:13::el7" } } } ], "category": "product_family", "name": "Red Hat OpenStack Platform" }, { "branches": [ { "category": "product_version", "name": "openstack-dashboard-1:13.0.3-7.el7ost.noarch", "product": { "name": "openstack-dashboard-1:13.0.3-7.el7ost.noarch", "product_id": "openstack-dashboard-1:13.0.3-7.el7ost.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/openstack-dashboard@13.0.3-7.el7ost?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "python-django-horizon-1:13.0.3-7.el7ost.noarch", "product": { "name": "python-django-horizon-1:13.0.3-7.el7ost.noarch", "product_id": "python-django-horizon-1:13.0.3-7.el7ost.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/python-django-horizon@13.0.3-7.el7ost?arch=noarch\u0026epoch=1" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "python-django-horizon-1:13.0.3-7.el7ost.src", "product": { "name": "python-django-horizon-1:13.0.3-7.el7ost.src", "product_id": "python-django-horizon-1:13.0.3-7.el7ost.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/python-django-horizon@13.0.3-7.el7ost?arch=src\u0026epoch=1" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "openstack-dashboard-1:13.0.3-7.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server", "product_id": "7Server-7.6.EUS-RH7-RHOS-13.0:openstack-dashboard-1:13.0.3-7.el7ost.noarch" }, "product_reference": "openstack-dashboard-1:13.0.3-7.el7ost.noarch", "relates_to_product_reference": "7Server-7.6.EUS-RH7-RHOS-13.0" }, { "category": "default_component_of", "full_product_name": { "name": "python-django-horizon-1:13.0.3-7.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server", "product_id": "7Server-7.6.EUS-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.noarch" }, "product_reference": "python-django-horizon-1:13.0.3-7.el7ost.noarch", "relates_to_product_reference": "7Server-7.6.EUS-RH7-RHOS-13.0" }, { "category": "default_component_of", "full_product_name": { "name": "python-django-horizon-1:13.0.3-7.el7ost.src as a component of Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server", "product_id": "7Server-7.6.EUS-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.src" }, "product_reference": "python-django-horizon-1:13.0.3-7.el7ost.src", "relates_to_product_reference": "7Server-7.6.EUS-RH7-RHOS-13.0" }, { "category": "default_component_of", "full_product_name": { "name": "openstack-dashboard-1:13.0.3-7.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0", "product_id": "7Server-RH7-RHOS-13.0:openstack-dashboard-1:13.0.3-7.el7ost.noarch" }, "product_reference": "openstack-dashboard-1:13.0.3-7.el7ost.noarch", "relates_to_product_reference": "7Server-RH7-RHOS-13.0" }, { "category": "default_component_of", "full_product_name": { "name": "python-django-horizon-1:13.0.3-7.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0", "product_id": "7Server-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.noarch" }, "product_reference": "python-django-horizon-1:13.0.3-7.el7ost.noarch", "relates_to_product_reference": "7Server-RH7-RHOS-13.0" }, { "category": "default_component_of", "full_product_name": { "name": "python-django-horizon-1:13.0.3-7.el7ost.src as a component of Red Hat OpenStack Platform 13.0", "product_id": "7Server-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.src" }, "product_reference": "python-django-horizon-1:13.0.3-7.el7ost.src", "relates_to_product_reference": "7Server-RH7-RHOS-13.0" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Pritam Singh" ], "organization": "Red Hat", "summary": "This issue was discovered by Red Hat." } ], "cve": "CVE-2020-29565", "cwe": { "id": "CWE-601", "name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)" }, "discovery_date": "2020-02-27T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1811510" } ], "notes": [ { "category": "description", "text": "A flaw was found in python-django-horizon. The \"next\" parameter is not correctly validated allowing a remote attacker to supply a malicious URL in the dashboard that could cause an automatic redirect to the provided malicious site. The highest threat from this vulnerability is to data confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "python-django-horizon: dashboard allows open redirect", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-7.6.EUS-RH7-RHOS-13.0:openstack-dashboard-1:13.0.3-7.el7ost.noarch", "7Server-7.6.EUS-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.noarch", "7Server-7.6.EUS-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.src", "7Server-RH7-RHOS-13.0:openstack-dashboard-1:13.0.3-7.el7ost.noarch", "7Server-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.noarch", "7Server-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-29565" }, { "category": "external", "summary": "RHBZ#1811510", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1811510" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-29565", "url": "https://www.cve.org/CVERecord?id=CVE-2020-29565" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-29565", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-29565" }, { "category": "external", "summary": "https://www.openwall.com/lists/oss-security/2020/12/08/2", "url": "https://www.openwall.com/lists/oss-security/2020/12/08/2" } ], "release_date": "2020-02-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-12-16T13:54:29+00:00", "details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-7.6.EUS-RH7-RHOS-13.0:openstack-dashboard-1:13.0.3-7.el7ost.noarch", "7Server-7.6.EUS-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.noarch", "7Server-7.6.EUS-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.src", "7Server-RH7-RHOS-13.0:openstack-dashboard-1:13.0.3-7.el7ost.noarch", "7Server-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.noarch", "7Server-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:5572" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "7Server-7.6.EUS-RH7-RHOS-13.0:openstack-dashboard-1:13.0.3-7.el7ost.noarch", "7Server-7.6.EUS-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.noarch", "7Server-7.6.EUS-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.src", "7Server-RH7-RHOS-13.0:openstack-dashboard-1:13.0.3-7.el7ost.noarch", "7Server-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.noarch", "7Server-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.src" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "7Server-7.6.EUS-RH7-RHOS-13.0:openstack-dashboard-1:13.0.3-7.el7ost.noarch", "7Server-7.6.EUS-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.noarch", "7Server-7.6.EUS-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.src", "7Server-RH7-RHOS-13.0:openstack-dashboard-1:13.0.3-7.el7ost.noarch", "7Server-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.noarch", "7Server-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "python-django-horizon: dashboard allows open redirect" } ] }
RHSA-2020:5411
Vulnerability from csaf_redhat
Published
2020-12-15 19:04
Modified
2025-09-26 04:57
Summary
Red Hat Security Advisory: python-django-horizon security update
Notes
Topic
An update for python-django-horizon is now available for Red Hat OpenStack
Platform 16.1 (Train).
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
Details
OpenStack Dashboard (horizon) provides administrators and users with a
graphical interface to access, provision, and automate cloud-based
resources.
Security Fix(es):
* dashboard allows open redirect (CVE-2020-29565)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for python-django-horizon is now available for Red Hat OpenStack\nPlatform 16.1 (Train).\n\nRed Hat Product Security has rated this update as having a security impact\nof Moderate. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "OpenStack Dashboard (horizon) provides administrators and users with a\ngraphical interface to access, provision, and automate cloud-based\nresources.\n\nSecurity Fix(es):\n\n* dashboard allows open redirect (CVE-2020-29565)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:5411", "url": "https://access.redhat.com/errata/RHSA-2020:5411" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "1811510", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1811510" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5411.json" } ], "title": "Red Hat Security Advisory: python-django-horizon security update", "tracking": { "current_release_date": "2025-09-26T04:57:03+00:00", "generator": { "date": "2025-09-26T04:57:03+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.8" } }, "id": "RHSA-2020:5411", "initial_release_date": "2020-12-15T19:04:30+00:00", "revision_history": [ { "date": "2020-12-15T19:04:30+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-12-15T19:04:30+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-09-26T04:57:03+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenStack Platform 16.1", "product": { "name": "Red Hat OpenStack Platform 16.1", "product_id": "8Base-RHOS-16.1", "product_identification_helper": { "cpe": "cpe:/a:redhat:openstack:16.1::el8" } } } ], "category": "product_family", "name": "Red Hat OpenStack Platform" }, { "branches": [ { "category": "product_version", "name": "openstack-dashboard-1:16.2.1-1.20201114033610.el8ost.noarch", "product": { "name": "openstack-dashboard-1:16.2.1-1.20201114033610.el8ost.noarch", "product_id": "openstack-dashboard-1:16.2.1-1.20201114033610.el8ost.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/openstack-dashboard@16.2.1-1.20201114033610.el8ost?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "python3-django-horizon-1:16.2.1-1.20201114033610.el8ost.noarch", "product": { "name": "python3-django-horizon-1:16.2.1-1.20201114033610.el8ost.noarch", "product_id": "python3-django-horizon-1:16.2.1-1.20201114033610.el8ost.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/python3-django-horizon@16.2.1-1.20201114033610.el8ost?arch=noarch\u0026epoch=1" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "python-django-horizon-1:16.2.1-1.20201114033610.el8ost.src", "product": { "name": "python-django-horizon-1:16.2.1-1.20201114033610.el8ost.src", "product_id": "python-django-horizon-1:16.2.1-1.20201114033610.el8ost.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/python-django-horizon@16.2.1-1.20201114033610.el8ost?arch=src\u0026epoch=1" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "openstack-dashboard-1:16.2.1-1.20201114033610.el8ost.noarch as a component of Red Hat OpenStack Platform 16.1", "product_id": "8Base-RHOS-16.1:openstack-dashboard-1:16.2.1-1.20201114033610.el8ost.noarch" }, "product_reference": "openstack-dashboard-1:16.2.1-1.20201114033610.el8ost.noarch", "relates_to_product_reference": "8Base-RHOS-16.1" }, { "category": "default_component_of", "full_product_name": { "name": "python-django-horizon-1:16.2.1-1.20201114033610.el8ost.src as a component of Red Hat OpenStack Platform 16.1", "product_id": "8Base-RHOS-16.1:python-django-horizon-1:16.2.1-1.20201114033610.el8ost.src" }, "product_reference": "python-django-horizon-1:16.2.1-1.20201114033610.el8ost.src", "relates_to_product_reference": "8Base-RHOS-16.1" }, { "category": "default_component_of", "full_product_name": { "name": "python3-django-horizon-1:16.2.1-1.20201114033610.el8ost.noarch as a component of Red Hat OpenStack Platform 16.1", "product_id": "8Base-RHOS-16.1:python3-django-horizon-1:16.2.1-1.20201114033610.el8ost.noarch" }, "product_reference": "python3-django-horizon-1:16.2.1-1.20201114033610.el8ost.noarch", "relates_to_product_reference": "8Base-RHOS-16.1" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Pritam Singh" ], "organization": "Red Hat", "summary": "This issue was discovered by Red Hat." } ], "cve": "CVE-2020-29565", "cwe": { "id": "CWE-601", "name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)" }, "discovery_date": "2020-02-27T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1811510" } ], "notes": [ { "category": "description", "text": "A flaw was found in python-django-horizon. The \"next\" parameter is not correctly validated allowing a remote attacker to supply a malicious URL in the dashboard that could cause an automatic redirect to the provided malicious site. The highest threat from this vulnerability is to data confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "python-django-horizon: dashboard allows open redirect", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOS-16.1:openstack-dashboard-1:16.2.1-1.20201114033610.el8ost.noarch", "8Base-RHOS-16.1:python-django-horizon-1:16.2.1-1.20201114033610.el8ost.src", "8Base-RHOS-16.1:python3-django-horizon-1:16.2.1-1.20201114033610.el8ost.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-29565" }, { "category": "external", "summary": "RHBZ#1811510", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1811510" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-29565", "url": "https://www.cve.org/CVERecord?id=CVE-2020-29565" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-29565", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-29565" }, { "category": "external", "summary": "https://www.openwall.com/lists/oss-security/2020/12/08/2", "url": "https://www.openwall.com/lists/oss-security/2020/12/08/2" } ], "release_date": "2020-02-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-12-15T19:04:30+00:00", "details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOS-16.1:openstack-dashboard-1:16.2.1-1.20201114033610.el8ost.noarch", "8Base-RHOS-16.1:python-django-horizon-1:16.2.1-1.20201114033610.el8ost.src", "8Base-RHOS-16.1:python3-django-horizon-1:16.2.1-1.20201114033610.el8ost.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:5411" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "8Base-RHOS-16.1:openstack-dashboard-1:16.2.1-1.20201114033610.el8ost.noarch", "8Base-RHOS-16.1:python-django-horizon-1:16.2.1-1.20201114033610.el8ost.src", "8Base-RHOS-16.1:python3-django-horizon-1:16.2.1-1.20201114033610.el8ost.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-RHOS-16.1:openstack-dashboard-1:16.2.1-1.20201114033610.el8ost.noarch", "8Base-RHOS-16.1:python-django-horizon-1:16.2.1-1.20201114033610.el8ost.src", "8Base-RHOS-16.1:python3-django-horizon-1:16.2.1-1.20201114033610.el8ost.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "python-django-horizon: dashboard allows open redirect" } ] }
rhsa-2020_5572
Vulnerability from csaf_redhat
Published
2020-12-16 13:54
Modified
2024-11-15 07:26
Summary
Red Hat Security Advisory: python-django-horizon security update
Notes
Topic
An update for python-django-horizon is now available for Red Hat OpenStack
Platform 13 (Queens).
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
Details
OpenStack Dashboard (horizon) provides administrators and users with a
graphical interface to access, provision, and automate cloud-based
resources.
Security Fix(es):
* python-django-horizon: dashboard allows open redirect (CVE-2020-29565)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for python-django-horizon is now available for Red Hat OpenStack\nPlatform 13 (Queens).\n\nRed Hat Product Security has rated this update as having a security impact\nof Moderate. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "OpenStack Dashboard (horizon) provides administrators and users with a\ngraphical interface to access, provision, and automate cloud-based\nresources.\n\nSecurity Fix(es):\n\n* python-django-horizon: dashboard allows open redirect (CVE-2020-29565)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:5572", "url": "https://access.redhat.com/errata/RHSA-2020:5572" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "1811510", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1811510" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5572.json" } ], "title": "Red Hat Security Advisory: python-django-horizon security update", "tracking": { "current_release_date": "2024-11-15T07:26:37+00:00", "generator": { "date": "2024-11-15T07:26:37+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2020:5572", "initial_release_date": "2020-12-16T13:54:29+00:00", "revision_history": [ { "date": "2020-12-16T13:54:29+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-12-16T13:54:29+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-15T07:26:37+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenStack Platform 13.0", "product": { "name": "Red Hat OpenStack Platform 13.0", "product_id": "7Server-RH7-RHOS-13.0", "product_identification_helper": { "cpe": "cpe:/a:redhat:openstack:13::el7" } } }, { "category": "product_name", "name": "Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server", "product": { "name": "Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server", "product_id": "7Server-7.6.EUS-RH7-RHOS-13.0", "product_identification_helper": { "cpe": "cpe:/a:redhat:openstack:13::el7" } } } ], "category": "product_family", "name": "Red Hat OpenStack Platform" }, { "branches": [ { "category": "product_version", "name": "openstack-dashboard-1:13.0.3-7.el7ost.noarch", "product": { "name": "openstack-dashboard-1:13.0.3-7.el7ost.noarch", "product_id": "openstack-dashboard-1:13.0.3-7.el7ost.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/openstack-dashboard@13.0.3-7.el7ost?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "python-django-horizon-1:13.0.3-7.el7ost.noarch", "product": { "name": "python-django-horizon-1:13.0.3-7.el7ost.noarch", "product_id": "python-django-horizon-1:13.0.3-7.el7ost.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/python-django-horizon@13.0.3-7.el7ost?arch=noarch\u0026epoch=1" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "python-django-horizon-1:13.0.3-7.el7ost.src", "product": { "name": "python-django-horizon-1:13.0.3-7.el7ost.src", "product_id": "python-django-horizon-1:13.0.3-7.el7ost.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/python-django-horizon@13.0.3-7.el7ost?arch=src\u0026epoch=1" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "openstack-dashboard-1:13.0.3-7.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server", "product_id": "7Server-7.6.EUS-RH7-RHOS-13.0:openstack-dashboard-1:13.0.3-7.el7ost.noarch" }, "product_reference": "openstack-dashboard-1:13.0.3-7.el7ost.noarch", "relates_to_product_reference": "7Server-7.6.EUS-RH7-RHOS-13.0" }, { "category": "default_component_of", "full_product_name": { "name": "python-django-horizon-1:13.0.3-7.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server", "product_id": "7Server-7.6.EUS-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.noarch" }, "product_reference": "python-django-horizon-1:13.0.3-7.el7ost.noarch", "relates_to_product_reference": "7Server-7.6.EUS-RH7-RHOS-13.0" }, { "category": "default_component_of", "full_product_name": { "name": "python-django-horizon-1:13.0.3-7.el7ost.src as a component of Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server", "product_id": "7Server-7.6.EUS-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.src" }, "product_reference": "python-django-horizon-1:13.0.3-7.el7ost.src", "relates_to_product_reference": "7Server-7.6.EUS-RH7-RHOS-13.0" }, { "category": "default_component_of", "full_product_name": { "name": "openstack-dashboard-1:13.0.3-7.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0", "product_id": "7Server-RH7-RHOS-13.0:openstack-dashboard-1:13.0.3-7.el7ost.noarch" }, "product_reference": "openstack-dashboard-1:13.0.3-7.el7ost.noarch", "relates_to_product_reference": "7Server-RH7-RHOS-13.0" }, { "category": "default_component_of", "full_product_name": { "name": "python-django-horizon-1:13.0.3-7.el7ost.noarch as a component of Red Hat OpenStack Platform 13.0", "product_id": "7Server-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.noarch" }, "product_reference": "python-django-horizon-1:13.0.3-7.el7ost.noarch", "relates_to_product_reference": "7Server-RH7-RHOS-13.0" }, { "category": "default_component_of", "full_product_name": { "name": "python-django-horizon-1:13.0.3-7.el7ost.src as a component of Red Hat OpenStack Platform 13.0", "product_id": "7Server-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.src" }, "product_reference": "python-django-horizon-1:13.0.3-7.el7ost.src", "relates_to_product_reference": "7Server-RH7-RHOS-13.0" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Pritam Singh" ], "organization": "Red Hat", "summary": "This issue was discovered by Red Hat." } ], "cve": "CVE-2020-29565", "cwe": { "id": "CWE-601", "name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)" }, "discovery_date": "2020-02-27T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1811510" } ], "notes": [ { "category": "description", "text": "A flaw was found in python-django-horizon. The \"next\" parameter is not correctly validated allowing a remote attacker to supply a malicious URL in the dashboard that could cause an automatic redirect to the provided malicious site. The highest threat from this vulnerability is to data confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "python-django-horizon: dashboard allows open redirect", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-7.6.EUS-RH7-RHOS-13.0:openstack-dashboard-1:13.0.3-7.el7ost.noarch", "7Server-7.6.EUS-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.noarch", "7Server-7.6.EUS-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.src", "7Server-RH7-RHOS-13.0:openstack-dashboard-1:13.0.3-7.el7ost.noarch", "7Server-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.noarch", "7Server-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-29565" }, { "category": "external", "summary": "RHBZ#1811510", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1811510" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-29565", "url": "https://www.cve.org/CVERecord?id=CVE-2020-29565" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-29565", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-29565" }, { "category": "external", "summary": "https://www.openwall.com/lists/oss-security/2020/12/08/2", "url": "https://www.openwall.com/lists/oss-security/2020/12/08/2" } ], "release_date": "2020-02-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-12-16T13:54:29+00:00", "details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-7.6.EUS-RH7-RHOS-13.0:openstack-dashboard-1:13.0.3-7.el7ost.noarch", "7Server-7.6.EUS-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.noarch", "7Server-7.6.EUS-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.src", "7Server-RH7-RHOS-13.0:openstack-dashboard-1:13.0.3-7.el7ost.noarch", "7Server-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.noarch", "7Server-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:5572" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "7Server-7.6.EUS-RH7-RHOS-13.0:openstack-dashboard-1:13.0.3-7.el7ost.noarch", "7Server-7.6.EUS-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.noarch", "7Server-7.6.EUS-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.src", "7Server-RH7-RHOS-13.0:openstack-dashboard-1:13.0.3-7.el7ost.noarch", "7Server-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.noarch", "7Server-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.src" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "7Server-7.6.EUS-RH7-RHOS-13.0:openstack-dashboard-1:13.0.3-7.el7ost.noarch", "7Server-7.6.EUS-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.noarch", "7Server-7.6.EUS-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.src", "7Server-RH7-RHOS-13.0:openstack-dashboard-1:13.0.3-7.el7ost.noarch", "7Server-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.noarch", "7Server-RH7-RHOS-13.0:python-django-horizon-1:13.0.3-7.el7ost.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "python-django-horizon: dashboard allows open redirect" } ] }
ghsa-f8fh-xp28-q59m
Vulnerability from github
Published
2022-05-24 17:35
Modified
2024-09-20 21:51
Severity ?
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
5.3 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
5.3 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
VLAI Severity ?
Summary
OpenStack Horizon Open redirect in workflow forms
Details
An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the "next" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL.
{ "affected": [ { "package": { "ecosystem": "PyPI", "name": "horizon" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "15.3.2" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "PyPI", "name": "horizon" }, "ranges": [ { "events": [ { "introduced": "16.0.0" }, { "fixed": "16.2.1" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "PyPI", "name": "horizon" }, "ranges": [ { "events": [ { "introduced": "17.0.0" }, { "fixed": "18.3.3" } ], "type": "ECOSYSTEM" } ] }, { "package": { "ecosystem": "PyPI", "name": "horizon" }, "ranges": [ { "events": [ { "introduced": "18.4.0" }, { "fixed": "18.6.0" } ], "type": "ECOSYSTEM" } ] } ], "aliases": [ "CVE-2020-29565" ], "database_specific": { "cwe_ids": [ "CWE-601" ], "github_reviewed": true, "github_reviewed_at": "2024-04-29T11:01:41Z", "nvd_published_at": "2020-12-04T08:15:00Z", "severity": "MODERATE" }, "details": "An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the \"next\" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL.", "id": "GHSA-f8fh-xp28-q59m", "modified": "2024-09-20T21:51:56Z", "published": "2022-05-24T17:35:25Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-29565" }, { "type": "WEB", "url": "https://github.com/openstack/horizon/commit/252467100f75587e18df9c43ed5802ee8f0017fa" }, { "type": "WEB", "url": "https://github.com/openstack/horizon/commit/6c208edf323ced07b15ec4bc3879bddb91d398bc" }, { "type": "WEB", "url": "https://github.com/openstack/horizon/commit/9e0e333ab5277b6c396f602862ff90398cb0242b" }, { "type": "WEB", "url": "https://github.com/openstack/horizon/commit/baa370f84332ad41502daea29a551705696f4421" }, { "type": "WEB", "url": "https://bugs.launchpad.net/horizon/+bug/1865026" }, { "type": "PACKAGE", "url": "https://github.com/openstack/horizon" }, { "type": "WEB", "url": "https://github.com/pypa/advisory-database/tree/main/vulns/horizon/PYSEC-2020-45.yaml" }, { "type": "WEB", "url": "https://review.opendev.org/c/openstack/horizon/+/758841" }, { "type": "WEB", "url": "https://review.opendev.org/c/openstack/horizon/+/758843" }, { "type": "WEB", "url": "https://security.openstack.org/ossa/OSSA-2020-008.html" }, { "type": "WEB", "url": "https://www.debian.org/security/2020/dsa-4820" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2020/12/08/2" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "type": "CVSS_V3" }, { "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "type": "CVSS_V4" } ], "summary": "OpenStack Horizon Open redirect in workflow forms" }
pysec-2020-45
Vulnerability from pysec
Published
2020-12-04 08:15
Modified
2021-03-09 15:08
Details
An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the "next" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL.
Impacted products
Name | purl | horizon | pkg:pypi/horizon |
---|
Aliases
{ "affected": [ { "package": { "ecosystem": "PyPI", "name": "horizon", "purl": "pkg:pypi/horizon" }, "ranges": [ { "events": [ { "introduced": "15.3.0" }, { "fixed": "15.3.2" }, { "introduced": "16.0.0" }, { "fixed": "16.2.1" }, { "introduced": "17.0.0" }, { "fixed": "18.3.3" }, { "introduced": "18.4.0" }, { "fixed": "18.6.0" } ], "type": "ECOSYSTEM" } ], "versions": [ "15.3.0", "15.3.1", "16.0.0", "16.1.0", "16.2.0", "17.0.0", "17.1.0", "18.0.0", "18.1.0", "18.2.0", "18.3.0", "18.3.1", "18.3.2", "18.4.0", "18.4.1", "18.5.0" ] } ], "aliases": [ "CVE-2020-29565" ], "details": "An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the \"next\" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL.", "id": "PYSEC-2020-45", "modified": "2021-03-09T15:08:00Z", "published": "2020-12-04T08:15:00Z", "references": [ { "type": "WEB", "url": "https://bugs.launchpad.net/horizon/+bug/1865026" }, { "type": "WEB", "url": "https://review.opendev.org/c/openstack/horizon/+/758841/" }, { "type": "WEB", "url": "https://review.opendev.org/c/openstack/horizon/+/758843/" }, { "type": "WEB", "url": "https://security.openstack.org/ossa/OSSA-2020-008.html" }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2020/12/08/2" }, { "type": "ADVISORY", "url": "https://www.debian.org/security/2020/dsa-4820" } ] }
suse-su-2021:0099-1
Vulnerability from csaf_suse
Published
2021-01-12 18:47
Modified
2021-01-12 18:47
Summary
Security update for openstack-dashboard, release-notes-suse-openstack-cloud
Notes
Title of the patch
Security update for openstack-dashboard, release-notes-suse-openstack-cloud
Description of the patch
This update for openstack-dashboard, release-notes-suse-openstack-cloud fixes the following issues:
- Fix open redirect (OSSA-2020-008, CVE-2020-29565)
- Fix horizon-nodejs jobs.
- Add workaround for secure boot issue when shim package is updated. (bsc#1179955)
Patchnames
HPE-Helion-OpenStack-8-2021-99,SUSE-2021-99,SUSE-OpenStack-Cloud-8-2021-99,SUSE-OpenStack-Cloud-Crowbar-8-2021-99
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ "document": { "aggregate_severity": { "namespace": "https://www.suse.com/support/security/rating/", "text": "important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright 2024 SUSE LLC. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Security update for openstack-dashboard, release-notes-suse-openstack-cloud", "title": "Title of the patch" }, { "category": "description", "text": "This update for openstack-dashboard, release-notes-suse-openstack-cloud fixes the following issues:\n\n- Fix open redirect (OSSA-2020-008, CVE-2020-29565)\n- Fix horizon-nodejs jobs.\n- Add workaround for secure boot issue when shim package is updated. (bsc#1179955)\n", "title": "Description of the patch" }, { "category": "details", "text": "HPE-Helion-OpenStack-8-2021-99,SUSE-2021-99,SUSE-OpenStack-Cloud-8-2021-99,SUSE-OpenStack-Cloud-Crowbar-8-2021-99", "title": "Patchnames" }, { "category": "legal_disclaimer", "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", "title": "Terms of use" } ], "publisher": { "category": "vendor", "contact_details": "https://www.suse.com/support/security/contact/", "name": "SUSE Product Security Team", "namespace": "https://www.suse.com/" }, "references": [ { "category": "external", "summary": "SUSE ratings", "url": "https://www.suse.com/support/security/rating/" }, { "category": "self", "summary": "URL of this CSAF notice", "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2021_0099-1.json" }, { "category": "self", "summary": "URL for SUSE-SU-2021:0099-1", "url": "https://www.suse.com/support/update/announcement/2021/suse-su-20210099-1/" }, { "category": "self", "summary": "E-Mail link for SUSE-SU-2021:0099-1", "url": "https://lists.suse.com/pipermail/sle-security-updates/2021-January/008190.html" }, { "category": "self", "summary": "SUSE Bug 1179955", "url": "https://bugzilla.suse.com/1179955" }, { "category": "self", "summary": "SUSE CVE CVE-2020-29565 page", "url": "https://www.suse.com/security/cve/CVE-2020-29565/" } ], "title": "Security update for openstack-dashboard, release-notes-suse-openstack-cloud", "tracking": { "current_release_date": "2021-01-12T18:47:08Z", "generator": { "date": "2021-01-12T18:47:08Z", "engine": { "name": "cve-database.git:bin/generate-csaf.pl", "version": "1" } }, "id": "SUSE-SU-2021:0099-1", "initial_release_date": "2021-01-12T18:47:08Z", "revision_history": [ { "date": "2021-01-12T18:47:08Z", "number": "1", "summary": "Current version" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "openstack-dashboard-12.0.5~dev6-3.29.1.noarch", "product": { "name": "openstack-dashboard-12.0.5~dev6-3.29.1.noarch", "product_id": "openstack-dashboard-12.0.5~dev6-3.29.1.noarch" } }, { "category": "product_version", "name": "python-horizon-12.0.5~dev6-3.29.1.noarch", "product": { "name": "python-horizon-12.0.5~dev6-3.29.1.noarch", "product_id": "python-horizon-12.0.5~dev6-3.29.1.noarch" } }, { "category": "product_version", "name": "release-notes-hpe-helion-openstack-8.20201214-3.26.1.noarch", "product": { "name": "release-notes-hpe-helion-openstack-8.20201214-3.26.1.noarch", "product_id": "release-notes-hpe-helion-openstack-8.20201214-3.26.1.noarch" } }, { "category": "product_version", "name": "openstack-dashboard-test-12.0.5~dev6-3.29.1.noarch", "product": { "name": "openstack-dashboard-test-12.0.5~dev6-3.29.1.noarch", "product_id": "openstack-dashboard-test-12.0.5~dev6-3.29.1.noarch" } }, { "category": "product_version", "name": "release-notes-suse-openstack-cloud-8.20201214-3.26.1.noarch", "product": { "name": "release-notes-suse-openstack-cloud-8.20201214-3.26.1.noarch", "product_id": "release-notes-suse-openstack-cloud-8.20201214-3.26.1.noarch" } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_name", "name": "HPE Helion OpenStack 8", "product": { "name": "HPE Helion OpenStack 8", "product_id": "HPE Helion OpenStack 8", "product_identification_helper": { "cpe": "cpe:/o:suse:hpe-helion-openstack:8" } } }, { "category": "product_name", "name": "SUSE OpenStack Cloud 8", "product": { "name": "SUSE OpenStack Cloud 8", "product_id": "SUSE OpenStack Cloud 8", "product_identification_helper": { "cpe": "cpe:/o:suse:suse-openstack-cloud:8" } } }, { "category": "product_name", "name": "SUSE OpenStack Cloud Crowbar 8", "product": { "name": "SUSE OpenStack Cloud Crowbar 8", "product_id": "SUSE OpenStack Cloud Crowbar 8", "product_identification_helper": { "cpe": "cpe:/o:suse:suse-openstack-cloud-crowbar:8" } } } ], "category": "product_family", "name": "SUSE Linux Enterprise" } ], "category": "vendor", "name": "SUSE" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "openstack-dashboard-12.0.5~dev6-3.29.1.noarch as component of HPE Helion OpenStack 8", "product_id": "HPE Helion OpenStack 8:openstack-dashboard-12.0.5~dev6-3.29.1.noarch" }, "product_reference": "openstack-dashboard-12.0.5~dev6-3.29.1.noarch", "relates_to_product_reference": "HPE Helion OpenStack 8" }, { "category": "default_component_of", "full_product_name": { "name": "python-horizon-12.0.5~dev6-3.29.1.noarch as component of HPE Helion OpenStack 8", "product_id": "HPE Helion OpenStack 8:python-horizon-12.0.5~dev6-3.29.1.noarch" }, "product_reference": "python-horizon-12.0.5~dev6-3.29.1.noarch", "relates_to_product_reference": "HPE Helion OpenStack 8" }, { "category": "default_component_of", "full_product_name": { "name": "release-notes-hpe-helion-openstack-8.20201214-3.26.1.noarch as component of HPE Helion OpenStack 8", "product_id": "HPE Helion OpenStack 8:release-notes-hpe-helion-openstack-8.20201214-3.26.1.noarch" }, "product_reference": "release-notes-hpe-helion-openstack-8.20201214-3.26.1.noarch", "relates_to_product_reference": "HPE Helion OpenStack 8" }, { "category": "default_component_of", "full_product_name": { "name": "openstack-dashboard-12.0.5~dev6-3.29.1.noarch as component of SUSE OpenStack Cloud 8", "product_id": "SUSE OpenStack Cloud 8:openstack-dashboard-12.0.5~dev6-3.29.1.noarch" }, "product_reference": "openstack-dashboard-12.0.5~dev6-3.29.1.noarch", "relates_to_product_reference": "SUSE OpenStack Cloud 8" }, { "category": "default_component_of", "full_product_name": { "name": "python-horizon-12.0.5~dev6-3.29.1.noarch as component of SUSE OpenStack Cloud 8", "product_id": "SUSE OpenStack Cloud 8:python-horizon-12.0.5~dev6-3.29.1.noarch" }, "product_reference": "python-horizon-12.0.5~dev6-3.29.1.noarch", "relates_to_product_reference": "SUSE OpenStack Cloud 8" }, { "category": "default_component_of", "full_product_name": { "name": "release-notes-suse-openstack-cloud-8.20201214-3.26.1.noarch as component of SUSE OpenStack Cloud 8", "product_id": "SUSE OpenStack Cloud 8:release-notes-suse-openstack-cloud-8.20201214-3.26.1.noarch" }, "product_reference": "release-notes-suse-openstack-cloud-8.20201214-3.26.1.noarch", "relates_to_product_reference": "SUSE OpenStack Cloud 8" }, { "category": "default_component_of", "full_product_name": { "name": "openstack-dashboard-12.0.5~dev6-3.29.1.noarch as component of SUSE OpenStack Cloud Crowbar 8", "product_id": "SUSE OpenStack Cloud Crowbar 8:openstack-dashboard-12.0.5~dev6-3.29.1.noarch" }, "product_reference": "openstack-dashboard-12.0.5~dev6-3.29.1.noarch", "relates_to_product_reference": "SUSE OpenStack Cloud Crowbar 8" }, { "category": "default_component_of", "full_product_name": { "name": "python-horizon-12.0.5~dev6-3.29.1.noarch as component of SUSE OpenStack Cloud Crowbar 8", "product_id": "SUSE OpenStack Cloud Crowbar 8:python-horizon-12.0.5~dev6-3.29.1.noarch" }, "product_reference": "python-horizon-12.0.5~dev6-3.29.1.noarch", "relates_to_product_reference": "SUSE OpenStack Cloud Crowbar 8" }, { "category": "default_component_of", "full_product_name": { "name": "release-notes-suse-openstack-cloud-8.20201214-3.26.1.noarch as component of SUSE OpenStack Cloud Crowbar 8", "product_id": "SUSE OpenStack Cloud Crowbar 8:release-notes-suse-openstack-cloud-8.20201214-3.26.1.noarch" }, "product_reference": "release-notes-suse-openstack-cloud-8.20201214-3.26.1.noarch", "relates_to_product_reference": "SUSE OpenStack Cloud Crowbar 8" } ] }, "vulnerabilities": [ { "cve": "CVE-2020-29565", "ids": [ { "system_name": "SUSE CVE Page", "text": "https://www.suse.com/security/cve/CVE-2020-29565" } ], "notes": [ { "category": "general", "text": "An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the \"next\" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL.", "title": "CVE description" } ], "product_status": { "recommended": [ "HPE Helion OpenStack 8:openstack-dashboard-12.0.5~dev6-3.29.1.noarch", "HPE Helion OpenStack 8:python-horizon-12.0.5~dev6-3.29.1.noarch", "HPE Helion OpenStack 8:release-notes-hpe-helion-openstack-8.20201214-3.26.1.noarch", "SUSE OpenStack Cloud 8:openstack-dashboard-12.0.5~dev6-3.29.1.noarch", "SUSE OpenStack Cloud 8:python-horizon-12.0.5~dev6-3.29.1.noarch", "SUSE OpenStack Cloud 8:release-notes-suse-openstack-cloud-8.20201214-3.26.1.noarch", "SUSE OpenStack Cloud Crowbar 8:openstack-dashboard-12.0.5~dev6-3.29.1.noarch", "SUSE OpenStack Cloud Crowbar 8:python-horizon-12.0.5~dev6-3.29.1.noarch", "SUSE OpenStack Cloud Crowbar 8:release-notes-suse-openstack-cloud-8.20201214-3.26.1.noarch" ] }, "references": [ { "category": "external", "summary": "CVE-2020-29565", "url": "https://www.suse.com/security/cve/CVE-2020-29565" }, { "category": "external", "summary": "SUSE Bug 1181019 for CVE-2020-29565", "url": "https://bugzilla.suse.com/1181019" } ], "remediations": [ { "category": "vendor_fix", "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", "product_ids": [ "HPE Helion OpenStack 8:openstack-dashboard-12.0.5~dev6-3.29.1.noarch", "HPE Helion OpenStack 8:python-horizon-12.0.5~dev6-3.29.1.noarch", "HPE Helion OpenStack 8:release-notes-hpe-helion-openstack-8.20201214-3.26.1.noarch", "SUSE OpenStack Cloud 8:openstack-dashboard-12.0.5~dev6-3.29.1.noarch", "SUSE OpenStack Cloud 8:python-horizon-12.0.5~dev6-3.29.1.noarch", "SUSE OpenStack Cloud 8:release-notes-suse-openstack-cloud-8.20201214-3.26.1.noarch", "SUSE OpenStack Cloud Crowbar 8:openstack-dashboard-12.0.5~dev6-3.29.1.noarch", "SUSE OpenStack Cloud Crowbar 8:python-horizon-12.0.5~dev6-3.29.1.noarch", "SUSE OpenStack Cloud Crowbar 8:release-notes-suse-openstack-cloud-8.20201214-3.26.1.noarch" ] } ], "scores": [ { "cvss_v3": { "baseScore": 6.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "HPE Helion OpenStack 8:openstack-dashboard-12.0.5~dev6-3.29.1.noarch", "HPE Helion OpenStack 8:python-horizon-12.0.5~dev6-3.29.1.noarch", "HPE Helion OpenStack 8:release-notes-hpe-helion-openstack-8.20201214-3.26.1.noarch", "SUSE OpenStack Cloud 8:openstack-dashboard-12.0.5~dev6-3.29.1.noarch", "SUSE OpenStack Cloud 8:python-horizon-12.0.5~dev6-3.29.1.noarch", "SUSE OpenStack Cloud 8:release-notes-suse-openstack-cloud-8.20201214-3.26.1.noarch", "SUSE OpenStack Cloud Crowbar 8:openstack-dashboard-12.0.5~dev6-3.29.1.noarch", "SUSE OpenStack Cloud Crowbar 8:python-horizon-12.0.5~dev6-3.29.1.noarch", "SUSE OpenStack Cloud Crowbar 8:release-notes-suse-openstack-cloud-8.20201214-3.26.1.noarch" ] } ], "threats": [ { "category": "impact", "date": "2021-01-12T18:47:08Z", "details": "moderate" } ], "title": "CVE-2020-29565" } ] }
gsd-2020-29565
Vulnerability from gsd
Modified
2023-12-13 01:22
Details
An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the "next" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL.
Aliases
Aliases
{ "GSD": { "alias": "CVE-2020-29565", "description": "An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the \"next\" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL.", "id": "GSD-2020-29565", "references": [ "https://www.suse.com/security/cve/CVE-2020-29565.html", "https://www.debian.org/security/2020/dsa-4820", "https://access.redhat.com/errata/RHSA-2020:5572", "https://access.redhat.com/errata/RHSA-2020:5411", "https://ubuntu.com/security/CVE-2020-29565" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2020-29565" ], "details": "An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the \"next\" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL.", "id": "GSD-2020-29565", "modified": "2023-12-13T01:22:11.783438Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2020-29565", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the \"next\" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "https://bugs.launchpad.net/horizon/+bug/1865026", "refsource": "MISC", "url": "https://bugs.launchpad.net/horizon/+bug/1865026" }, { "name": "https://review.opendev.org/c/openstack/horizon/+/758841/", "refsource": "MISC", "url": "https://review.opendev.org/c/openstack/horizon/+/758841/" }, { "name": "https://review.opendev.org/c/openstack/horizon/+/758843/", "refsource": "MISC", "url": "https://review.opendev.org/c/openstack/horizon/+/758843/" }, { "name": "https://security.openstack.org/ossa/OSSA-2020-008.html", "refsource": "CONFIRM", "url": "https://security.openstack.org/ossa/OSSA-2020-008.html" }, { "name": "[oss-security] 20201207 [OSSA-2020-008] horizon: Open redirect in workflow forms (CVE-2020-29565)", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2020/12/08/2" }, { "name": "DSA-4820", "refsource": "DEBIAN", "url": "https://www.debian.org/security/2020/dsa-4820" } ] } }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:openstack:horizon:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "15.3.2", "versionStartIncluding": "15.3.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:openstack:horizon:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "16.2.1", "versionStartIncluding": "16.0.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:openstack:horizon:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "18.3.3", "versionStartIncluding": "17.0.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:openstack:horizon:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "18.5.0", "versionStartIncluding": "18.4.0", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2020-29565" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the \"next\" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-601" } ] } ] }, "references": { "reference_data": [ { "name": "https://bugs.launchpad.net/horizon/+bug/1865026", "refsource": "MISC", "tags": [ "Exploit", "Issue Tracking", "Third Party Advisory" ], "url": "https://bugs.launchpad.net/horizon/+bug/1865026" }, { "name": "https://review.opendev.org/c/openstack/horizon/+/758841/", "refsource": "MISC", "tags": [ "Patch", "Third Party Advisory" ], "url": "https://review.opendev.org/c/openstack/horizon/+/758841/" }, { "name": "https://review.opendev.org/c/openstack/horizon/+/758843/", "refsource": "MISC", "tags": [ "Patch", "Third Party Advisory" ], "url": "https://review.opendev.org/c/openstack/horizon/+/758843/" }, { "name": "https://security.openstack.org/ossa/OSSA-2020-008.html", "refsource": "CONFIRM", "tags": [ "Patch", "Vendor Advisory" ], "url": "https://security.openstack.org/ossa/OSSA-2020-008.html" }, { "name": "[oss-security] 20201207 [OSSA-2020-008] horizon: Open redirect in workflow forms (CVE-2020-29565)", "refsource": "MLIST", "tags": [ "Mailing List", "Patch", "Third Party Advisory" ], "url": "http://www.openwall.com/lists/oss-security/2020/12/08/2" }, { "name": "DSA-4820", "refsource": "DEBIAN", "tags": [ "Third Party Advisory" ], "url": "https://www.debian.org/security/2020/dsa-4820" } ] } }, "impact": { "baseMetricV2": { "acInsufInfo": false, "cvssV2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0" }, "exploitabilityScore": 8.6, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true }, "baseMetricV3": { "cvssV3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "exploitabilityScore": 2.8, "impactScore": 2.7 } }, "lastModifiedDate": "2021-03-09T15:08Z", "publishedDate": "2020-12-04T08:15Z" } } }
fkie_cve-2020-29565
Vulnerability from fkie_nvd
Published
2020-12-04 08:15
Modified
2024-11-21 05:24
Severity ?
Summary
An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the "next" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL.
References
Impacted products
{ "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:openstack:horizon:*:*:*:*:*:*:*:*", "matchCriteriaId": "73CBE2A7-7561-403A-BA84-D72179C49B63", "versionEndExcluding": "15.3.2", "versionStartIncluding": "15.3.0", "vulnerable": true }, { "criteria": "cpe:2.3:a:openstack:horizon:*:*:*:*:*:*:*:*", "matchCriteriaId": "A14EB5AB-402A-4485-A46A-1689E6F16AB2", "versionEndExcluding": "16.2.1", "versionStartIncluding": "16.0.0", "vulnerable": true }, { "criteria": "cpe:2.3:a:openstack:horizon:*:*:*:*:*:*:*:*", "matchCriteriaId": "9B65C2BD-8285-45AE-9C73-35749668B047", "versionEndExcluding": "18.3.3", "versionStartIncluding": "17.0.0", "vulnerable": true }, { "criteria": "cpe:2.3:a:openstack:horizon:*:*:*:*:*:*:*:*", "matchCriteriaId": "08C9AD76-3326-499F-B860-D22EC858FD52", "versionEndIncluding": "18.5.0", "versionStartIncluding": "18.4.0", "vulnerable": true } ], "negate": false, "operator": "OR" } ] }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the \"next\" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL." }, { "lang": "es", "value": "Se detect\u00f3 un problema en OpenStack Horizon versiones 15.3.2, versiones 16.x anteriores a 16.2.1, versiones 17.x y versiones 18.x anteriores a 18.3.3, versiones 18.4.x y 18.5.x.\u0026#xa0;Se presenta una falta de comprobaci\u00f3n del par\u00e1metro \"next\", lo que permitir\u00eda a alguien proporcionar una URL maliciosa en Horizon que puede causar un redireccionamiento autom\u00e1tico a la URL maliciosa proporcionada" } ], "id": "CVE-2020-29565", "lastModified": "2024-11-21T05:24:12.760", "metrics": { "cvssMetricV2": [ { "acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0" }, "exploitabilityScore": 8.6, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true } ], "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary" } ] }, "published": "2020-12-04T08:15:11.143", "references": [ { "source": "cve@mitre.org", "tags": [ "Mailing List", "Patch", "Third Party Advisory" ], "url": "http://www.openwall.com/lists/oss-security/2020/12/08/2" }, { "source": "cve@mitre.org", "tags": [ "Exploit", "Issue Tracking", "Third Party Advisory" ], "url": "https://bugs.launchpad.net/horizon/+bug/1865026" }, { "source": "cve@mitre.org", "tags": [ "Patch", "Third Party Advisory" ], "url": "https://review.opendev.org/c/openstack/horizon/+/758841/" }, { "source": "cve@mitre.org", "tags": [ "Patch", "Third Party Advisory" ], "url": "https://review.opendev.org/c/openstack/horizon/+/758843/" }, { "source": "cve@mitre.org", "tags": [ "Patch", "Vendor Advisory" ], "url": "https://security.openstack.org/ossa/OSSA-2020-008.html" }, { "source": "cve@mitre.org", "tags": [ "Third Party Advisory" ], "url": "https://www.debian.org/security/2020/dsa-4820" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Mailing List", "Patch", "Third Party Advisory" ], "url": "http://www.openwall.com/lists/oss-security/2020/12/08/2" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Exploit", "Issue Tracking", "Third Party Advisory" ], "url": "https://bugs.launchpad.net/horizon/+bug/1865026" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Patch", "Third Party Advisory" ], "url": "https://review.opendev.org/c/openstack/horizon/+/758841/" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Patch", "Third Party Advisory" ], "url": "https://review.opendev.org/c/openstack/horizon/+/758843/" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Patch", "Vendor Advisory" ], "url": "https://security.openstack.org/ossa/OSSA-2020-008.html" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory" ], "url": "https://www.debian.org/security/2020/dsa-4820" } ], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-601" } ], "source": "nvd@nist.gov", "type": "Primary" } ] }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…