CVE-2020-26943
- State
- Published
- Severity
- Not scored
- Published
- Oct 16, 2020
- Updated
- Aug 4, 2024
- Reserved
- Oct 10, 2020
Description
An issue was discovered in OpenStack blazar-dashboard before 1.3.1, 2.0.0, and 3.0.0. A user allowed to access the Blazar dashboard in Horizon may trigger code execution on the Horizon host as the user the Horizon service runs under (because the Python eval function is used). This may result in Horizon host unauthorized access and further compromise of the Horizon service. All setups using the Horizon dashboard with the blazar-dashboard plugin are affected.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- https://launchpad.net/bugs/1895688
- https://review.opendev.org/755810
- https://review.opendev.org/756064
- https://review.opendev.org/755812
- https://review.opendev.org/755813
- https://review.opendev.org/755814
- https://security.openstack.org/ossa/OSSA-2020-007.html
- [oss-security] 20201016 [OSSA-2020-007] Blazar: Remote code execution in blazar-dashboard (CVE-2020-26943)mailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.