Open Redirect vulnerability in Horizon Web Dashboard 19.4.0 thru 20.1.4 via the success_url parameter.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00286.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Openstack
  • Horizon

Configuration 1 [-]

cpe:2.3:a:openstack:horizon:*:*:*:*:*:*:*:*

No data.

No data.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-3678-1 horizon security update - CORRECTED ANNOUNCEMENT
EUVD EUVD EUVD-2023-0094 Open Redirect vulnerability in Horizon Web Dashboard 19.4.0 thru 20.1.4 via the success_url parameter.
Github GHSA Github GHSA GHSA-5pv6-rprw-82wv Horizon Web Dashboard Open Redirect vulnerability
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://bugs.launchpad.net/horizon/+bug/1982676 cve-icon cve-icon
https://github.com/openstack/horizon/blob/master/horizon/workflows/views.py#L96-L102 cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2023/11/msg00033.html cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2023/12/msg00000.html cve-icon cve-icon
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2024-08-03T14:17:03.817Z

Reserved: 2022-11-21T00:00:00

Link: CVE-2022-45582

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2023-08-22T19:16:30.107

Modified: 2024-11-21T07:29:27.527

Link: CVE-2022-45582

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.