EUVD-2025-209588Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered reflected XSS with no auth required; scope changes to victim browser; no availability impact applies.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the zone attribute parameter.
AnalysisAI
Reflected cross-site scripting in OpenNebula 6.10.0.1 allows unauthenticated remote attackers to inject arbitrary JavaScript into the zone attribute parameter of the web management interface, executing in the security context of a victim user's browser session upon interaction. A public proof-of-concept exploit exists on GitHub, confirmed by SSVC classification of 'poc'. EPSS probability sits at 0.03% (8th percentile), indicating low observed exploitation activity, and the vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
OpenNebula is an open-source cloud computing and data center virtualization platform providing infrastructure management via a web UI. The vulnerability resides in how the application processes the zone attribute parameter - a component related to multi-zone cloud resource management - without properly sanitizing or encoding user-supplied input before rendering it in the browser. CWE-79 (Improper Neutralization of Input During Web Page Generation) is the root cause: the application fails to escape or validate attacker-controlled input before embedding it into the DOM, allowing script injection. The CVSS Scope:Changed (S:C) metric confirms that successful exploitation crosses security boundaries - the attacker's payload executes within the victim's authenticated browser session, potentially accessing resources beyond the originating context. Affected CPE: cpe:2.3:a:opennebula:opennebula:*:*:*:*:*:*:*:* (wildcard version range per NVD; only version 6.10.0.1 is specifically named in the description).
RemediationAI
The primary remediation path is to upgrade to OpenNebula 7.x, as suggested by the vendor's release announcement at opennebula.io/opennebula-7/; however, an exact fix version with confirmed security patch inclusion has not been independently verified from the available reference data. As a compensating control where immediate upgrade is not feasible, administrators should implement a Content Security Policy (CSP) header on the OpenNebula web interface to restrict inline script execution, which would significantly reduce the exploitability of this XSS vector - note that CSP configuration requires careful tuning to avoid breaking legitimate application functionality. Additionally, restricting access to the OpenNebula web UI to trusted internal networks or VPN reduces the attack surface by limiting who can deliver crafted payloads to administrative users. The VulDB advisory at vuldb.com/vuln/360177 and the PoC at github.com/MarkArtamonov/OpenNebula-CVE-2025-56535 should be reviewed for additional technical mitigations.
More in Opennebula
View allImproper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in OpenNebula OpenNebu
Broken authorization in OpenNebula's `one.vm.exec` API function allows any authenticated low-privilege user to execute a
Unrestricted Upload of File with Dangerous Type vulnerability in OpenNebula OpenNebula core on Linux allows File Content
Files or Directories Accessible to External Parties vulnerability in OpenNebula on Linux allows File Discovery. Rated me
Stored cross-site scripting in OpenNebula v6.10.0.1 allows an attacker to persist a malicious payload inside the virtual
Stored cross-site scripting in OpenNebula 6.10.0.1 allows attackers to inject persistent malicious scripts via the user
Cross-site scripting in OpenNebula v6.10.0.1's custom authenticator driver enables unauthenticated remote attackers to i
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today