Technical impact
Stored cross‑site scripting vulnerability in OpenNebula 6.10.0.1 allows an attacker to inject a crafted payload into the virtual network template parameter. When the template is rendered, the injected script or HTML is executed in the browser of any user who views it, enabling arbitrary client‑side code execution. The weakness aligns with CWE‑79.
Affected Systems
OpenNebula Platform version 6.10.0.1 is affected. The issue has been fixed in OpenNebula 7.0, so users of any earlier releases face this risk. No other vendors or products were reported, and the vulnerability is specific to the virtual network template handling component of OpenNebula.
Risk and Exploitability
The CVSS score is 6.1 and the EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. Attacks would require access to the OpenNebula web interface and the ability to create or modify virtual network templates, which typically requires authenticated privileged access. Given the lack of public exploit evidence, the likelihood of exploitation appears low, but the impact of successful exploitation is high due to the arbitrary code execution in clients.
