CVE-2020-26943
published 2020-10-16CVE-2020-26943: An issue was discovered in OpenStack blazar-dashboard before 1.3.1, 2.0.0, and 3.0.0. A user allowed to access the Blazar dashboard in Horizon may trigger code…
PriorityP263critical9.9CVSS 3.1
AVNACLPRLUINSCCHIHAH
EPSS
3.12%
86.2th percentile
An issue was discovered in OpenStack blazar-dashboard before 1.3.1, 2.0.0, and 3.0.0. A user allowed to access the Blazar dashboard in Horizon may trigger code execution on the Horizon host as the user the Horizon service runs under (because the Python eval function is used). This may result in Horizon host unauthorized access and further compromise of the Horizon service. All setups using the Horizon dashboard with the blazar-dashboard plugin are affected.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openstack | blazar-dashboard | < 1.3.1 | 1.3.1 |
| openstack | blazar-dashboard | — | — |
| openstack | blazar-dashboard | — | — |
| openstack | blazar-dashboard | >= 0 < 1.3.1 | 1.3.1 |
| openstack | blazar-dashboard | >= 2.0.0 < 2.0.1 | 2.0.1 |
| openstack | blazar-dashboard | >= 3.0.0 < 3.0.1 | 3.0.1 |
CVSS provenance
nvdv3.19.9CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Arbitrary Code Execution in blazar-dashboard
osv·2020-10-27
CVE-2020-26943 [MEDIUM] Arbitrary Code Execution in blazar-dashboard
Arbitrary Code Execution in blazar-dashboard
An issue was discovered in OpenStack blazar-dashboard before 1.3.1, 2.0.0, and 3.0.0. A user allowed to access the Blazar dashboard in Horizon may trigger code execution on the Horizon host as the user the Horizon service runs under (because the Python eval function is used). This may result in Horizon host unauthorized access and further compromise of the Horizon service. All setups using the Horizon dashboard with the blazar-dashboard plugin are affected.
GHSA
Arbitrary Code Execution in blazar-dashboard
ghsa·2020-10-27
CVE-2020-26943 [MEDIUM] CWE-94 Arbitrary Code Execution in blazar-dashboard
Arbitrary Code Execution in blazar-dashboard
An issue was discovered in OpenStack blazar-dashboard before 1.3.1, 2.0.0, and 3.0.0. A user allowed to access the Blazar dashboard in Horizon may trigger code execution on the Horizon host as the user the Horizon service runs under (because the Python eval function is used). This may result in Horizon host unauthorized access and further compromise of the Horizon service. All setups using the Horizon dashboard with the blazar-dashboard plugin are affected.
OSV
CVE-2020-26943: An issue was discovered in OpenStack blazar-dashboard before 1
osv·2020-10-16
CVE-2020-26943 CVE-2020-26943: An issue was discovered in OpenStack blazar-dashboard before 1
An issue was discovered in OpenStack blazar-dashboard before 1.3.1, 2.0.0, and 3.0.0. A user allowed to access the Blazar dashboard in Horizon may trigger code execution on the Horizon host as the user the Horizon service runs under (because the Python eval function is used). This may result in Horizon host unauthorized access and further compromise of the Horizon service. All setups using the Horizon dashboard with the blazar-dashboard plugin are affected.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.openwall.com/lists/oss-security/2020/10/16/5https://launchpad.net/bugs/1895688https://review.opendev.org/755810https://review.opendev.org/755812https://review.opendev.org/755813https://review.opendev.org/755814https://review.opendev.org/756064https://security.openstack.org/ossa/OSSA-2020-007.htmlhttp://www.openwall.com/lists/oss-security/2020/10/16/5https://launchpad.net/bugs/1895688https://review.opendev.org/755810https://review.opendev.org/755812https://review.opendev.org/755813https://review.opendev.org/755814https://review.opendev.org/756064https://security.openstack.org/ossa/OSSA-2020-007.html
2020-10-16
Published