Bug 1950479 (CVE-2021-3529) - CVE-2021-3529 noobaa-core: Cross-site scripting vulnerability with noobaa management URL
Summary: CVE-2021-3529 noobaa-core: Cross-site scripting vulnerability with noobaa man...
Keywords:
Status: NEW
Alias: CVE-2021-3529
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: Red Hat1943388
Blocks: Embargoed1950483 Red Hat1955816
TreeView+ depends on / blocked
 
Reported: 2021-04-16 17:35 UTC by Pedro Sampaio
Modified: 2023-01-31 22:28 UTC (History)
3 users (show)

Fixed In Version: noobaa 5.7.0
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in noobaa-core. This flaw results in the name of an arbitrary URL copied into an HTML document as plain text between tags, including a potential payload script. The input is echoed unmodified in the application response, resulting in arbitrary JavaScript being injected into an application's response. The highest threat to the system is to confidentiality, integrity, as well as system availability.
Clone Of:
Environment:
Last Closed:

Attachments (Terms of Use)

Description Pedro Sampaio 2021-04-16 17:35:28 UTC 
The name of an arbitrarily supplied URL parameter is copied into the HTML document as plain text between tags on openshift-container-storage-4 with Noobaa. This results in an XSS attack, as this URL can include a payload script. 

References:

Red Hathttps://bugzilla.redhat.com/show_bug.cgi?id=1943388
Note You need to log in before you can comment on or make changes to this bug.