OpenNebula Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in OpenNebula version 6.10.0.1. This vulnerability allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the user information parameter. The issue is present in the OpenNebula Sunstone component.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, inject a payload, such as an image tag with an 'onerror' event, into the user information parameter. Once the payload is saved, it will be executed when the user information is viewed.

Remediation

Users are advised to upgrade to OpenNebula version 7.0 or later.