OpenNebula Stored Cross-Site Scripting Vulnerability in Virtual Network Template
Vulnerability
A stored cross-site scripting vulnerability has been identified in OpenNebula versions prior to 7.0, specifically in version 6.10.0.1. This vulnerability allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the virtual network template parameter. The issue resides within the OpenNebula Sunstone component.
Impact
Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.
Reproduction
To reproduce this vulnerability, inject a payload, such as an image tag with an 'onerror' event, into the virtual network template parameter in OpenNebula 6.10.0.1. Once the template is saved, the injected script will execute when the template is viewed, demonstrating the cross-site scripting vulnerability.
Remediation
Users are advised to upgrade to OpenNebula version 7.0 or later.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.