CVE-2021-3654
published 2022-03-02CVE-2021-3654: A vulnerability was found in openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL.
medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EXPLOIT
A vulnerability was found in openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | nova | < nova 2:23.0.2-3 (bookworm) | nova 2:23.0.2-3 (bookworm) |
| openstack | nova | < 21.2.3 | 21.2.3 |
| openstack | nova | >= 0 < 2:23.0.2-3 | 2:23.0.2-3 |
| openstack | nova | >= 0 < 2:23.0.2-3 | 2:23.0.2-3 |
| openstack | nova | >= 0 < 2:23.0.2-3 | 2:23.0.2-3 |
| openstack | nova | >= 0 < 21.2.3 | 21.2.3 |
| openstack | nova | >= 0 < 2:17.0.13-0ubuntu5.3 | 2:17.0.13-0ubuntu5.3 |
| openstack | nova | >= 0 < 2:21.2.4-0ubuntu2.2 | 2:21.2.4-0ubuntu2.2 |
| openstack | nova | >= 0 < 2:13.1.4-0ubuntu4.5+esm1 | 2:13.1.4-0ubuntu4.5+esm1 |
| openstack | nova | >= 22.0.0 < 22.2.3 | 22.2.3 |
| openstack | nova | >= 22.0.0 < 22.2.3 | 22.2.3 |
| openstack | nova | >= 23.0.0 < 23.0.3 | 23.0.3 |
| openstack | nova | >= 23.0.0 < 23.0.3 | 23.0.3 |
| redhat | openstack_platform | — | — |
| redhat | openstack_platform | — | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
osv6.1MEDIUM