CVE-2016-6519 Openstack Manila Persistent XSS in Metadata field
MediumCVSS 5.4
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in the "Shares" overview in Openstack Manila before 2.5.1 allows remote authenticated users to inject arbitrary web script or HTML via the Metadata field in the "Create Share" form.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi manila-ui(PyPI) | < 2.5.1 | 2.5.1 |
| pypi manila-ui(PyPI) | = 0.1.0 | No fix listed |
| pypi manila-ui(PyPI) | = 1.0.0 | No fix listed |
| pypi manila-ui(PyPI) | = 1.0.1 | No fix listed |
| pypi manila-ui(PyPI) | = 1.1.0 | No fix listed |
| pypi manila-ui(PyPI) | = 1.2.0 | No fix listed |
| pypi manila-ui(PyPI) | = 2.0.0 | No fix listed |
| pypi manila-ui(PyPI) | = 2.1.0 | No fix listed |
| pypi manila-ui(PyPI) | = 2.2.0 | No fix listed |
| pypi manila-ui(PyPI) | = 2.3.0 | No fix listed |
| pypi manila-ui(PyPI) | = 2.4.0 | No fix listed |
| pypi manila-ui(PyPI) | = 2.5.0 | No fix listed |
| debian/manila-ui(Debian:12) | < 2.5.1-0 | 2.5.1-0 |
| debian/manila-ui(Debian:13) | < 2.5.1-0 | 2.5.1-0 |
| debian/manila-ui(Debian:14) | < 2.5.1-0 | 2.5.1-0 |
| redhat openstack | = 7.0 | No fix listed |
| redhat openstack | = 8 | No fix listed |
| redhat openstack | = 9 | No fix listed |
| OpenStack Manila | <= 2.5 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- bugs.launchpad.net
- bugzilla.redhat.com
- RHSA-2016:2115 vendor-advisory
- RHSA-2016:2116 vendor-advisory
- RHSA-2016:2117 vendor-advisory
- [oss-security] 20160915 CVE-2016-6519: openstack-manila: Persistent XSS in Metadata field mailing-list
- 93001 vdb-entry
- pypi.org product
- github.com vendor-advisory
- Debian Security Tracker CVE-2016-6519 vendor-advisory
- bugs.debian.org issue-tracking