6.1

CVE-2021-3654

Exploit
A vulnerability was found in openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Openstack ≫ Nova Version < 21.2.3
Openstack ≫ Nova Version >= 22.0.0 < 22.2.3
Openstack ≫ Nova Version >= 23.0.0 < 23.0.3
Redhat ≫ Openstack Platform Version16.1
Redhat ≫ Openstack Platform Version16.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 26.79% 0.978
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvd@nist.gov 4 4.9 4.9
AV:N/AC:H/Au:N/C:P/I:P/A:N
CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

https://security.gentoo.org/glsa/202305-02
https://bugs.launchpad.net/nova/+bug/1927677
Patch
Third Party Advisory
Exploit
Issue Tracking
https://bugs.python.org/issue32084
Patch
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1961439
Patch
Third Party Advisory
Issue Tracking
https://opendev.org/openstack/nova/commit/04d48527b62a35d912f93bc75613a6cca606df66
Patch
Vendor Advisory
https://opendev.org/openstack/nova/commit/8906552cfc2525a44251d4cf313ece61e57251eb
Patch
Vendor Advisory
https://security.openstack.org/ossa/OSSA-2021-002.html
Patch
Vendor Advisory
https://www.openwall.com/lists/oss-security/2021/07/29/2
Patch
Third Party Advisory
Mailing List