CVE-2021-3654

MEDIUMNuclei

Open Redirect in CPython that affects users of OpenStack Nova

Title source: GitHub Advisory
STIX 2.1 vulnerability

Record summary

CVE-2021-3654 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

A vulnerability was found in openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

2
ProductSourceVersion range

openstack-nova

CVE ListAffects - Nova: <21.2.3, >=22.0.0 <22.2.3, >=23.0.0 <23.0.3 | Fixed-In 21.2.3, 22.3.0, and 23.1.0affected

nova

Browse PyPI / nova
GitHub AdvisoryBefore 21.2.3 · Fixed in 21.2.3affected
22.0.0 to < 22.2.3 · Fixed in 22.2.3affected
23.0.0 to < 23.0.3 · Fixed in 23.0.3affected

Nuclei templates

1
ProjectDiscoveryMEDIUMNova noVNC - Open RedirectCVSS 6.1

Nova noVNC contains an open redirect vulnerability. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations.

Impact

An attacker can exploit this vulnerability to redirect users to malicious websites, leading to potential phishing attacks.

Remediation

Apply the latest security patches or updates provided by the vendor to fix the open redirect vulnerability in the Nova noVNC application.

WeaknessesCWE-601
Authorsgeeknik
Template tagscve2021cveredirectnovncseclistsopenstackvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:*
https://seclists.org/oss-sec/2021/q3/188 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3654 https://bugs.python.org/issue32084 https://opendev.org/openstack/nova/commit/04d48527b62a35d912f93bc75613a6cca606df66 https://nvd.nist.gov/vuln/detail/CVE-2021-3654

Source: ProjectDiscovery

References

10