NVD Vulnerability Detail

CVE-2020-26943

Summary	An issue was discovered in OpenStack blazar-dashboard before 1.3.1, 2.0.0, and 3.0.0. A user allowed to access the Blazar dashboard in Horizon may trigger code execution on the Horizon host as the user the Horizon service runs under (because the Python eval function is used). This may result in Horizon host unauthorized access and further compromise of the Horizon service. All setups using the Horizon dashboard with the blazar-dashboard plugin are affected.
Publication Date	Oct. 16, 2020, 3:15 p.m.
Registration Date	Jan. 26, 2021, 11:56 a.m.
Last Update	Nov. 21, 2024, 2:20 p.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:openstack:blazar-dashboard:3.0.0:::::::*
cpe:2.3:a:openstack:blazar-dashboard:2.0.0:::::::*
cpe:2.3:a:openstack:blazar-dashboard::::::::				1.3.1

Related information, measures and tools

No	URL	タグ
1	http://www.openwall.com/lists/oss-security/2020/10/16/5	Third Party Advisory
2	http://www.openwall.com/lists/oss-security/2020/10/16/5	Third Party Advisory
3	https://launchpad.net/bugs/1895688	Third Party Advisory
4	https://launchpad.net/bugs/1895688	Third Party Advisory
5	https://review.opendev.org/755810	Third Party Advisory
6	https://review.opendev.org/755810	Third Party Advisory
7	https://review.opendev.org/755812	Third Party Advisory
8	https://review.opendev.org/755812	Third Party Advisory
9	https://review.opendev.org/755813	Third Party Advisory
10	https://review.opendev.org/755813	Third Party Advisory
11	https://review.opendev.org/755814	Third Party Advisory
12	https://review.opendev.org/755814	Third Party Advisory
13	https://review.opendev.org/756064	Third Party Advisory
14	https://review.opendev.org/756064	Third Party Advisory
15	https://security.openstack.org/ossa/OSSA-2020-007.html	Third Party Advisory
16	https://security.openstack.org/ossa/OSSA-2020-007.html	Third Party Advisory

Common Vulnerabilities List

JVN Vulnerability Information

OpenStack blazar-dashboard における脆弱性

Title	OpenStack blazar-dashboard における脆弱性
Summary	OpenStack blazar-dashboard には、不特定の脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Oct. 12, 2020, midnight
Registration Date	May 20, 2021, 3 p.m.
Last Update	May 20, 2021, 3 p.m.

Affected System

OpenStack

blazar-dashboard 1.3.1 未満

blazar-dashboard 2.0.0 未満

blazar-dashboard 3.0.0 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2020-26943	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26943
National Vulnerability Database (NVD)
2	CVE-2020-26943	https://nvd.nist.gov/vuln/detail/CVE-2020-26943

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-noinfo	https://www.ipa.go.jp/security/vuln/CWE.html#CWEnoinfo

ベンダー情報

No	Name	URL
OpenStack Security Advisories
1	OSSA-2020-007: Remote code execution in blazar-dashboard	https://security.openstack.org/ossa/OSSA-2020-007.html

Change Log

No	Changed Details	Date of change
1	[2021年05月20日] 掲載	May 20, 2021, 3 p.m.