Opennebula
Monthly
Broken authorization in OpenNebula's `one.vm.exec` API function allows any authenticated low-privilege user to execute arbitrary commands inside virtual machines owned by other users, across all versions prior to 7.4. The flaw stems from the platform's failure to verify whether the requesting user holds access rights to the target VM - only the VM's numeric identifier and an active qemu-agent are required. Full confidentiality, integrity, and availability compromise of victim VMs is achievable by any platform tenant; no public exploit has been identified at time of analysis, but the low complexity prerequisites make this a genuine priority for multi-tenant deployments.
Stored cross-site scripting in OpenNebula v6.10.0.1 allows an attacker to persist a malicious payload inside the virtual network template parameter, which then executes in the browser of any user who views the affected template. The Changed scope (S:C) in the CVSS vector confirms the injected script runs in the victim's browsing context, enabling session theft, credential harvesting, or UI redressing against platform administrators. A public proof-of-concept is confirmed by SSVC data; exploitation is not confirmed in CISA KEV, and the EPSS score of 0.03% (8th percentile) indicates low observed exploitation activity despite the POC's existence.
Stored cross-site scripting in OpenNebula 6.10.0.1 allows attackers to inject persistent malicious scripts via the user information parameter, which subsequently execute in the browsers of any user who views the affected content. The scope change in the CVSS vector (S:C) reflects that execution escapes the application's trust boundary into victims' browser sessions, enabling session hijacking or unauthorized UI actions. A proof-of-concept is publicly available on GitHub (SSVC confirms exploitation status as poc), though EPSS at 0.03% (8th percentile) and SSVC's non-automatable classification indicate this has not seen broad opportunistic exploitation.
Reflected cross-site scripting in OpenNebula 6.10.0.1 allows unauthenticated remote attackers to inject arbitrary JavaScript into the zone attribute parameter of the web management interface, executing in the security context of a victim user's browser session upon interaction. A public proof-of-concept exploit exists on GitHub, confirmed by SSVC classification of 'poc'. EPSS probability sits at 0.03% (8th percentile), indicating low observed exploitation activity, and the vulnerability is not listed in the CISA KEV catalog.
Cross-site scripting in OpenNebula v6.10.0.1's custom authenticator driver enables unauthenticated remote attackers to inject arbitrary JavaScript or HTML into victims' browsers via a crafted payload delivered through the authentication interface. A public proof-of-concept exploit exists (SSVC exploitation: poc, GitHub PoC referenced), though EPSS at 0.03% indicates minimal current exploitation activity and CISA KEV listing is absent. Because the vulnerable component is the authenticator driver - the portal login surface - successful exploitation could facilitate session token theft or credential phishing targeting cloud administrators, making impact disproportionate to the Medium CVSS score in privileged-user scenarios.
Unrestricted Upload of File with Dangerous Type vulnerability in OpenNebula OpenNebula core on Linux allows File Content Injection. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in OpenNebula OpenNebula core on Linux allows Remote Code Inclusion. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Files or Directories Accessible to External Parties vulnerability in OpenNebula on Linux allows File Discovery. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Broken authorization in OpenNebula's `one.vm.exec` API function allows any authenticated low-privilege user to execute arbitrary commands inside virtual machines owned by other users, across all versions prior to 7.4. The flaw stems from the platform's failure to verify whether the requesting user holds access rights to the target VM - only the VM's numeric identifier and an active qemu-agent are required. Full confidentiality, integrity, and availability compromise of victim VMs is achievable by any platform tenant; no public exploit has been identified at time of analysis, but the low complexity prerequisites make this a genuine priority for multi-tenant deployments.
Stored cross-site scripting in OpenNebula v6.10.0.1 allows an attacker to persist a malicious payload inside the virtual network template parameter, which then executes in the browser of any user who views the affected template. The Changed scope (S:C) in the CVSS vector confirms the injected script runs in the victim's browsing context, enabling session theft, credential harvesting, or UI redressing against platform administrators. A public proof-of-concept is confirmed by SSVC data; exploitation is not confirmed in CISA KEV, and the EPSS score of 0.03% (8th percentile) indicates low observed exploitation activity despite the POC's existence.
Stored cross-site scripting in OpenNebula 6.10.0.1 allows attackers to inject persistent malicious scripts via the user information parameter, which subsequently execute in the browsers of any user who views the affected content. The scope change in the CVSS vector (S:C) reflects that execution escapes the application's trust boundary into victims' browser sessions, enabling session hijacking or unauthorized UI actions. A proof-of-concept is publicly available on GitHub (SSVC confirms exploitation status as poc), though EPSS at 0.03% (8th percentile) and SSVC's non-automatable classification indicate this has not seen broad opportunistic exploitation.
Reflected cross-site scripting in OpenNebula 6.10.0.1 allows unauthenticated remote attackers to inject arbitrary JavaScript into the zone attribute parameter of the web management interface, executing in the security context of a victim user's browser session upon interaction. A public proof-of-concept exploit exists on GitHub, confirmed by SSVC classification of 'poc'. EPSS probability sits at 0.03% (8th percentile), indicating low observed exploitation activity, and the vulnerability is not listed in the CISA KEV catalog.
Cross-site scripting in OpenNebula v6.10.0.1's custom authenticator driver enables unauthenticated remote attackers to inject arbitrary JavaScript or HTML into victims' browsers via a crafted payload delivered through the authentication interface. A public proof-of-concept exploit exists (SSVC exploitation: poc, GitHub PoC referenced), though EPSS at 0.03% indicates minimal current exploitation activity and CISA KEV listing is absent. Because the vulnerable component is the authenticator driver - the portal login surface - successful exploitation could facilitate session token theft or credential phishing targeting cloud administrators, making impact disproportionate to the Medium CVSS score in privileged-user scenarios.
Unrestricted Upload of File with Dangerous Type vulnerability in OpenNebula OpenNebula core on Linux allows File Content Injection. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in OpenNebula OpenNebula core on Linux allows Remote Code Inclusion. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Files or Directories Accessible to External Parties vulnerability in OpenNebula on Linux allows File Discovery. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.