Back to search
CVE-2020-26943
Published: Oct 16, 2020
Modified: Aug 4, 2024
PUBLISHED
Description
An issue was discovered in OpenStack blazar-dashboard before 1.3.1, 2.0.0, and 3.0.0. A user allowed to access the Blazar dashboard in Horizon may trigger code execution on the Horizon host as the user the Horizon service runs under (because the Python eval function is used). This may result in Horizon host unauthorized access and further compromise of the Horizon service. All setups using the Horizon dashboard with the blazar-dashboard plugin are affected.
| Vendor | Product | Versions |
|---|---|---|
n/a | n/a | affected n/a |
References
https://launchpad.net/bugs/1895688
x_refsource_MISC
https://review.opendev.org/755810
x_refsource_MISC
https://review.opendev.org/756064
x_refsource_MISC
https://review.opendev.org/755812
x_refsource_MISC
https://review.opendev.org/755813
x_refsource_MISC
https://review.opendev.org/755814
x_refsource_MISC
https://security.openstack.org/ossa/OSSA-2020-007.html
x_refsource_CONFIRM
[oss-security] 20201016 [OSSA-2020-007] Blazar: Remote code execution in blazar-dashboard (CVE-2020-26943)
mailing-list
x_refsource_MLIST
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now