GitHub Advisoryadvisory · PyPI

GHSA-939m-4xpw-v34v Arbitrary Code Execution in blazar-dashboard

MEDIUM Published 2020-10-27 Modified 2024-09-06 Official page ↗
Aliases
CVE-2020-26943
Ecosystem
PyPI
Packages
blazar-dashboard
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2020-10-26

Affected packages

• PyPI blazar-dashboard: < 1.3.1 → fixed in 1.3.1 • PyPI blazar-dashboard: >= 2.0.0, < 2.0.1 → fixed in 2.0.1 • PyPI blazar-dashboard: >= 3.0.0, < 3.0.1 → fixed in 3.0.1

Description

An issue was discovered in OpenStack blazar-dashboard before 1.3.1, 2.0.0, and 3.0.0. A user allowed to access the Blazar dashboard in Horizon may trigger code execution on the Horizon host as the user the Horizon service runs under (because the Python eval function is used). This may result in Horizon host unauthorized access and further compromise of the Horizon service. All setups using the Horizon dashboard with the blazar-dashboard plugin are affected.

Related

Alias · CVE (1)

  • CVE-2020-26943 An issue was discovered in OpenStack blazar-dashboard before 1.3.1, 2.0.0, and 3.0.0. vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References