NetSight
IP …
medium5.1

CVE-2015-0259

OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows rem…

Impact

OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the authentication of users for access to consoles via a crafted webpage.

Affected products

VendorProductAffected versions
OpenstackNova
from 2014.1 before 2014.1.4
from 2014.2 before 2014.2.3
Version 2015.1.0

Weakness classification

CWE-345

References