CVE-2014-3497 OpenStack Swift Cross-site Scriping vulnerability
MediumCVSS 4.3
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in OpenStack Swift 1.11.0 through 1.13.1 allows remote attackers to inject arbitrary web script or HTML via the WWW-Authenticate header.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi swift(PyPI) | >= 1.11.0, <= 1.13.1 | No fix listed |
| pypi swift(PyPI) | >= 1.11.0, < 2.0.0 | 2.0.0 |
| debian/swift(Debian:12) | < 1.13.1-1 | 1.13.1-1 |
| debian/swift(Debian:13) | < 1.13.1-1 | 1.13.1-1 |
| debian/swift(Debian:14) | < 1.13.1-1 | 1.13.1-1 |
| OpenStack Swift | = 1.11.0 | No fix listed |
| OpenStack Swift | = 1.12.0 | No fix listed |
| OpenStack Swift | = 1.13.0 | No fix listed |
| OpenStack Swift | = 1.13.1 | No fix listed |
| OpenStack Swift | = 1.13.1-rc1 | No fix listed |
| OpenStack Swift | = 1.13.1-rc2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- review.openstack.org
- [openstack-announce] 20140619 [OSSA 2014-020] XSS in Swift requests through WWW-Authenticate header (CVE-2014-3497) mailing-list
- [oss-security] 20140619 [OSSA 2014-020] XSS in Swift requests through WWW-Authenticate header (CVE-2014-3497) mailing-list
- USN-2256-1 vendor-advisory
- access.redhat.com
- access.redhat.com
- bugzilla.redhat.com
- web.archive.org
- github.com vendor-advisory
- opendev.org product
- pypi.org product
- Debian Security Tracker CVE-2014-3497 vendor-advisory
- 59532 third-party-advisory
- 68116 vdb-entry
- bugs.debian.org issue-tracking