{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for openstack-manila-ui is now available for Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "OpenStack\u0027s File Share Service (manila) provides the means to easily provision shared file systems that can be consumed by multiple instances. These shared file systems are provisioned from pre-existing, back-end volumes. The UI component provides the dashboard plugin for the service.\n\nSecurity Fix(es):\n\n* A cross-site scripting flaw was discovered in openstack-manila-ui\u0027s Metadata field contained in its \"Create Share\" form. A user could inject malicious HTML/JavaScript code that would then be reflected in the \"Shares\" overview. Remote, authenticated, but unprivileged users could exploit this vulnerability to steal session cookies and escalate their privileges. (CVE-2016-6519)\n\nRed Hat would like to thank SUSE for reporting this issue.\nSUSE acknowledges Niklaus Schiess as the original reporter.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2016:2115",
        "url": "https://access.redhat.com/errata/RHSA-2016:2115"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "1375147",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1375147"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2115.json"
      }
    ],
    "title": "Red Hat Security Advisory: openstack-manila-ui security update",
    "tracking": {
      "current_release_date": "2024-11-14T20:50:08+00:00",
      "generator": {
        "date": "2024-11-14T20:50:08+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2016:2115",
      "initial_release_date": "2016-10-26T14:22:28+00:00",
      "revision_history": [
        {
          "date": "2016-10-26T14:22:28+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2016-10-26T14:22:28+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-14T20:50:08+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
                "product": {
                  "name": "Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
                  "product_id": "7Server-RH7-RHOS-7.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openstack:7::el7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenStack Platform"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openstack-manila-ui-0:1.0.1-3.el7ost.noarch",
                "product": {
                  "name": "openstack-manila-ui-0:1.0.1-3.el7ost.noarch",
                  "product_id": "openstack-manila-ui-0:1.0.1-3.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-manila-ui@1.0.1-3.el7ost?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openstack-manila-ui-0:1.0.1-3.el7ost.src",
                "product": {
                  "name": "openstack-manila-ui-0:1.0.1-3.el7ost.src",
                  "product_id": "openstack-manila-ui-0:1.0.1-3.el7ost.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-manila-ui@1.0.1-3.el7ost?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-manila-ui-0:1.0.1-3.el7ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
          "product_id": "7Server-RH7-RHOS-7.0:openstack-manila-ui-0:1.0.1-3.el7ost.noarch"
        },
        "product_reference": "openstack-manila-ui-0:1.0.1-3.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-7.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-manila-ui-0:1.0.1-3.el7ost.src as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
          "product_id": "7Server-RH7-RHOS-7.0:openstack-manila-ui-0:1.0.1-3.el7ost.src"
        },
        "product_reference": "openstack-manila-ui-0:1.0.1-3.el7ost.src",
        "relates_to_product_reference": "7Server-RH7-RHOS-7.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "SUSE"
          ]
        },
        {
          "names": [
            "Niklaus Schiess"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2016-6519",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2016-09-09T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1375147"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A cross-site scripting flaw was discovered in openstack-manila-ui\u0027s Metadata field contained in its \"Create Share\" form. A user could inject malicious HTML/JavaScript code that would then be reflected in the \"Shares\" overview. Remote, authenticated, but unprivileged users could exploit this vulnerability to steal session cookies and escalate their privileges.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openstack-manila-ui: persistent XSS in metadata field",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOS-7.0:openstack-manila-ui-0:1.0.1-3.el7ost.noarch",
          "7Server-RH7-RHOS-7.0:openstack-manila-ui-0:1.0.1-3.el7ost.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-6519"
        },
        {
          "category": "external",
          "summary": "RHBZ#1375147",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1375147"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-6519",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-6519"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6519",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6519"
        }
      ],
      "release_date": "2016-09-15T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-10-26T14:22:28+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-RH7-RHOS-7.0:openstack-manila-ui-0:1.0.1-3.el7ost.noarch",
            "7Server-RH7-RHOS-7.0:openstack-manila-ui-0:1.0.1-3.el7ost.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:2115"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOS-7.0:openstack-manila-ui-0:1.0.1-3.el7ost.noarch",
            "7Server-RH7-RHOS-7.0:openstack-manila-ui-0:1.0.1-3.el7ost.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openstack-manila-ui: persistent XSS in metadata field"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for openstack-manila-ui is now available for Red Hat OpenStack Platform 8.0 (Liberty).\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "OpenStack\u0027s File Share Service (manila) provides the means to easily provision shared file systems that can be consumed by multiple instances. These shared file systems are provisioned from pre-existing, back-end volumes. The UI component provides the dashboard plugin for the service.\n\nSecurity Fix(es):\n\n* A cross-site scripting flaw was discovered in openstack-manila-ui\u0027s Metadata field contained in its \"Create Share\" form. A user could inject malicious HTML/JavaScript code that would then be reflected in the \"Shares\" overview. Remote, authenticated, but unprivileged users could exploit this vulnerability to steal session cookies and escalate their privileges. (CVE-2016-6519)\n\nRed Hat would like to thank SUSE for reporting this issue. SUSE acknowledges Niklaus Schiess as the original reporter.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2016:2116",
        "url": "https://access.redhat.com/errata/RHSA-2016:2116"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "1375147",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1375147"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2116.json"
      }
    ],
    "title": "Red Hat Security Advisory: openstack-manila-ui security update",
    "tracking": {
      "current_release_date": "2024-11-14T20:50:00+00:00",
      "generator": {
        "date": "2024-11-14T20:50:00+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2016:2116",
      "initial_release_date": "2016-10-26T14:22:16+00:00",
      "revision_history": [
        {
          "date": "2016-10-26T14:22:16+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2016-10-26T14:22:16+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-14T20:50:00+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenStack Platform 8.0 (Liberty)",
                "product": {
                  "name": "Red Hat OpenStack Platform 8.0 (Liberty)",
                  "product_id": "7Server-RH7-RHOS-8.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openstack:8::el7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenStack Platform"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openstack-manila-ui-0:1.2.0-2.el7ost.noarch",
                "product": {
                  "name": "openstack-manila-ui-0:1.2.0-2.el7ost.noarch",
                  "product_id": "openstack-manila-ui-0:1.2.0-2.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-manila-ui@1.2.0-2.el7ost?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openstack-manila-ui-0:1.2.0-2.el7ost.src",
                "product": {
                  "name": "openstack-manila-ui-0:1.2.0-2.el7ost.src",
                  "product_id": "openstack-manila-ui-0:1.2.0-2.el7ost.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-manila-ui@1.2.0-2.el7ost?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-manila-ui-0:1.2.0-2.el7ost.noarch as a component of Red Hat OpenStack Platform 8.0 (Liberty)",
          "product_id": "7Server-RH7-RHOS-8.0:openstack-manila-ui-0:1.2.0-2.el7ost.noarch"
        },
        "product_reference": "openstack-manila-ui-0:1.2.0-2.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-8.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-manila-ui-0:1.2.0-2.el7ost.src as a component of Red Hat OpenStack Platform 8.0 (Liberty)",
          "product_id": "7Server-RH7-RHOS-8.0:openstack-manila-ui-0:1.2.0-2.el7ost.src"
        },
        "product_reference": "openstack-manila-ui-0:1.2.0-2.el7ost.src",
        "relates_to_product_reference": "7Server-RH7-RHOS-8.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "SUSE"
          ]
        },
        {
          "names": [
            "Niklaus Schiess"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2016-6519",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2016-09-09T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1375147"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A cross-site scripting flaw was discovered in openstack-manila-ui\u0027s Metadata field contained in its \"Create Share\" form. A user could inject malicious HTML/JavaScript code that would then be reflected in the \"Shares\" overview. Remote, authenticated, but unprivileged users could exploit this vulnerability to steal session cookies and escalate their privileges.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openstack-manila-ui: persistent XSS in metadata field",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOS-8.0:openstack-manila-ui-0:1.2.0-2.el7ost.noarch",
          "7Server-RH7-RHOS-8.0:openstack-manila-ui-0:1.2.0-2.el7ost.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-6519"
        },
        {
          "category": "external",
          "summary": "RHBZ#1375147",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1375147"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-6519",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-6519"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6519",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6519"
        }
      ],
      "release_date": "2016-09-15T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-10-26T14:22:16+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-RH7-RHOS-8.0:openstack-manila-ui-0:1.2.0-2.el7ost.noarch",
            "7Server-RH7-RHOS-8.0:openstack-manila-ui-0:1.2.0-2.el7ost.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:2116"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOS-8.0:openstack-manila-ui-0:1.2.0-2.el7ost.noarch",
            "7Server-RH7-RHOS-8.0:openstack-manila-ui-0:1.2.0-2.el7ost.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openstack-manila-ui: persistent XSS in metadata field"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for openstack-manila-ui is now available for Red Hat OpenStack Platform 9.0 (Mitaka).\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "OpenStack\u0027s File Share Service (manila) provides the means to easily provision shared file systems that can be consumed by multiple instances. These shared file systems are provisioned from pre-existing, back-end volumes. The UI component provides the dashboard plugin for the service.\n\nSecurity Fix(es):\n\n* A cross-site scripting flaw was discovered in openstack-manila-ui\u0027s Metadata field contained in its \"Create Share\" form. A user could inject malicious HTML/JavaScript code that would then be reflected in the \"Shares\" overview. Remote, authenticated, but unprivileged users could exploit this vulnerability to steal session cookies and escalate their privileges. (CVE-2016-6519)\n\nRed Hat would like to thank SUSE for reporting this issue. SUSE acknowledges Niklaus Schiess as the original reporter.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2016:2117",
        "url": "https://access.redhat.com/errata/RHSA-2016:2117"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "1375147",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1375147"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2117.json"
      }
    ],
    "title": "Red Hat Security Advisory: openstack-manila-ui security update",
    "tracking": {
      "current_release_date": "2024-11-14T20:49:54+00:00",
      "generator": {
        "date": "2024-11-14T20:49:54+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2016:2117",
      "initial_release_date": "2016-10-26T14:22:04+00:00",
      "revision_history": [
        {
          "date": "2016-10-26T14:22:04+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2016-10-26T14:22:04+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-14T20:49:54+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenStack Platform 9.0",
                "product": {
                  "name": "Red Hat OpenStack Platform 9.0",
                  "product_id": "7Server-RH7-RHOS-9.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openstack:9::el7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenStack Platform"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openstack-manila-ui-0:2.1.0-2.el7ost.noarch",
                "product": {
                  "name": "openstack-manila-ui-0:2.1.0-2.el7ost.noarch",
                  "product_id": "openstack-manila-ui-0:2.1.0-2.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-manila-ui@2.1.0-2.el7ost?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openstack-manila-ui-0:2.1.0-2.el7ost.src",
                "product": {
                  "name": "openstack-manila-ui-0:2.1.0-2.el7ost.src",
                  "product_id": "openstack-manila-ui-0:2.1.0-2.el7ost.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-manila-ui@2.1.0-2.el7ost?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-manila-ui-0:2.1.0-2.el7ost.noarch as a component of Red Hat OpenStack Platform 9.0",
          "product_id": "7Server-RH7-RHOS-9.0:openstack-manila-ui-0:2.1.0-2.el7ost.noarch"
        },
        "product_reference": "openstack-manila-ui-0:2.1.0-2.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-9.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-manila-ui-0:2.1.0-2.el7ost.src as a component of Red Hat OpenStack Platform 9.0",
          "product_id": "7Server-RH7-RHOS-9.0:openstack-manila-ui-0:2.1.0-2.el7ost.src"
        },
        "product_reference": "openstack-manila-ui-0:2.1.0-2.el7ost.src",
        "relates_to_product_reference": "7Server-RH7-RHOS-9.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "SUSE"
          ]
        },
        {
          "names": [
            "Niklaus Schiess"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2016-6519",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2016-09-09T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1375147"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A cross-site scripting flaw was discovered in openstack-manila-ui\u0027s Metadata field contained in its \"Create Share\" form. A user could inject malicious HTML/JavaScript code that would then be reflected in the \"Shares\" overview. Remote, authenticated, but unprivileged users could exploit this vulnerability to steal session cookies and escalate their privileges.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openstack-manila-ui: persistent XSS in metadata field",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOS-9.0:openstack-manila-ui-0:2.1.0-2.el7ost.noarch",
          "7Server-RH7-RHOS-9.0:openstack-manila-ui-0:2.1.0-2.el7ost.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-6519"
        },
        {
          "category": "external",
          "summary": "RHBZ#1375147",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1375147"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-6519",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-6519"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6519",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6519"
        }
      ],
      "release_date": "2016-09-15T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-10-26T14:22:04+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-RH7-RHOS-9.0:openstack-manila-ui-0:2.1.0-2.el7ost.noarch",
            "7Server-RH7-RHOS-9.0:openstack-manila-ui-0:2.1.0-2.el7ost.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:2117"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOS-9.0:openstack-manila-ui-0:2.1.0-2.el7ost.noarch",
            "7Server-RH7-RHOS-9.0:openstack-manila-ui-0:2.1.0-2.el7ost.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openstack-manila-ui: persistent XSS in metadata field"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for openstack-manila-ui is now available for Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "OpenStack\u0027s File Share Service (manila) provides the means to easily provision shared file systems that can be consumed by multiple instances. These shared file systems are provisioned from pre-existing, back-end volumes. The UI component provides the dashboard plugin for the service.\n\nSecurity Fix(es):\n\n* A cross-site scripting flaw was discovered in openstack-manila-ui\u0027s Metadata field contained in its \"Create Share\" form. A user could inject malicious HTML/JavaScript code that would then be reflected in the \"Shares\" overview. Remote, authenticated, but unprivileged users could exploit this vulnerability to steal session cookies and escalate their privileges. (CVE-2016-6519)\n\nRed Hat would like to thank SUSE for reporting this issue.\nSUSE acknowledges Niklaus Schiess as the original reporter.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2016:2115",
        "url": "https://access.redhat.com/errata/RHSA-2016:2115"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "1375147",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1375147"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2115.json"
      }
    ],
    "title": "Red Hat Security Advisory: openstack-manila-ui security update",
    "tracking": {
      "current_release_date": "2025-11-21T17:58:03+00:00",
      "generator": {
        "date": "2025-11-21T17:58:03+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.12"
        }
      },
      "id": "RHSA-2016:2115",
      "initial_release_date": "2016-10-26T14:22:28+00:00",
      "revision_history": [
        {
          "date": "2016-10-26T14:22:28+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2016-10-26T14:22:28+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-11-21T17:58:03+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
                "product": {
                  "name": "Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
                  "product_id": "7Server-RH7-RHOS-7.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openstack:7::el7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenStack Platform"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openstack-manila-ui-0:1.0.1-3.el7ost.noarch",
                "product": {
                  "name": "openstack-manila-ui-0:1.0.1-3.el7ost.noarch",
                  "product_id": "openstack-manila-ui-0:1.0.1-3.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-manila-ui@1.0.1-3.el7ost?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openstack-manila-ui-0:1.0.1-3.el7ost.src",
                "product": {
                  "name": "openstack-manila-ui-0:1.0.1-3.el7ost.src",
                  "product_id": "openstack-manila-ui-0:1.0.1-3.el7ost.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-manila-ui@1.0.1-3.el7ost?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-manila-ui-0:1.0.1-3.el7ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
          "product_id": "7Server-RH7-RHOS-7.0:openstack-manila-ui-0:1.0.1-3.el7ost.noarch"
        },
        "product_reference": "openstack-manila-ui-0:1.0.1-3.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-7.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-manila-ui-0:1.0.1-3.el7ost.src as a component of Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
          "product_id": "7Server-RH7-RHOS-7.0:openstack-manila-ui-0:1.0.1-3.el7ost.src"
        },
        "product_reference": "openstack-manila-ui-0:1.0.1-3.el7ost.src",
        "relates_to_product_reference": "7Server-RH7-RHOS-7.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "SUSE"
          ]
        },
        {
          "names": [
            "Niklaus Schiess"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2016-6519",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2016-09-09T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1375147"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A cross-site scripting flaw was discovered in openstack-manila-ui\u0027s Metadata field contained in its \"Create Share\" form. A user could inject malicious HTML/JavaScript code that would then be reflected in the \"Shares\" overview. Remote, authenticated, but unprivileged users could exploit this vulnerability to steal session cookies and escalate their privileges.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openstack-manila-ui: persistent XSS in metadata field",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOS-7.0:openstack-manila-ui-0:1.0.1-3.el7ost.noarch",
          "7Server-RH7-RHOS-7.0:openstack-manila-ui-0:1.0.1-3.el7ost.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-6519"
        },
        {
          "category": "external",
          "summary": "RHBZ#1375147",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1375147"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-6519",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-6519"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6519",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6519"
        }
      ],
      "release_date": "2016-09-15T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-10-26T14:22:28+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-RH7-RHOS-7.0:openstack-manila-ui-0:1.0.1-3.el7ost.noarch",
            "7Server-RH7-RHOS-7.0:openstack-manila-ui-0:1.0.1-3.el7ost.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:2115"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOS-7.0:openstack-manila-ui-0:1.0.1-3.el7ost.noarch",
            "7Server-RH7-RHOS-7.0:openstack-manila-ui-0:1.0.1-3.el7ost.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openstack-manila-ui: persistent XSS in metadata field"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for openstack-manila-ui is now available for Red Hat OpenStack Platform 9.0 (Mitaka).\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "OpenStack\u0027s File Share Service (manila) provides the means to easily provision shared file systems that can be consumed by multiple instances. These shared file systems are provisioned from pre-existing, back-end volumes. The UI component provides the dashboard plugin for the service.\n\nSecurity Fix(es):\n\n* A cross-site scripting flaw was discovered in openstack-manila-ui\u0027s Metadata field contained in its \"Create Share\" form. A user could inject malicious HTML/JavaScript code that would then be reflected in the \"Shares\" overview. Remote, authenticated, but unprivileged users could exploit this vulnerability to steal session cookies and escalate their privileges. (CVE-2016-6519)\n\nRed Hat would like to thank SUSE for reporting this issue. SUSE acknowledges Niklaus Schiess as the original reporter.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2016:2117",
        "url": "https://access.redhat.com/errata/RHSA-2016:2117"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "1375147",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1375147"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2117.json"
      }
    ],
    "title": "Red Hat Security Advisory: openstack-manila-ui security update",
    "tracking": {
      "current_release_date": "2025-11-21T17:58:04+00:00",
      "generator": {
        "date": "2025-11-21T17:58:04+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.12"
        }
      },
      "id": "RHSA-2016:2117",
      "initial_release_date": "2016-10-26T14:22:04+00:00",
      "revision_history": [
        {
          "date": "2016-10-26T14:22:04+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2016-10-26T14:22:04+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-11-21T17:58:04+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenStack Platform 9.0",
                "product": {
                  "name": "Red Hat OpenStack Platform 9.0",
                  "product_id": "7Server-RH7-RHOS-9.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openstack:9::el7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenStack Platform"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openstack-manila-ui-0:2.1.0-2.el7ost.noarch",
                "product": {
                  "name": "openstack-manila-ui-0:2.1.0-2.el7ost.noarch",
                  "product_id": "openstack-manila-ui-0:2.1.0-2.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-manila-ui@2.1.0-2.el7ost?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openstack-manila-ui-0:2.1.0-2.el7ost.src",
                "product": {
                  "name": "openstack-manila-ui-0:2.1.0-2.el7ost.src",
                  "product_id": "openstack-manila-ui-0:2.1.0-2.el7ost.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-manila-ui@2.1.0-2.el7ost?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-manila-ui-0:2.1.0-2.el7ost.noarch as a component of Red Hat OpenStack Platform 9.0",
          "product_id": "7Server-RH7-RHOS-9.0:openstack-manila-ui-0:2.1.0-2.el7ost.noarch"
        },
        "product_reference": "openstack-manila-ui-0:2.1.0-2.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-9.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-manila-ui-0:2.1.0-2.el7ost.src as a component of Red Hat OpenStack Platform 9.0",
          "product_id": "7Server-RH7-RHOS-9.0:openstack-manila-ui-0:2.1.0-2.el7ost.src"
        },
        "product_reference": "openstack-manila-ui-0:2.1.0-2.el7ost.src",
        "relates_to_product_reference": "7Server-RH7-RHOS-9.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "SUSE"
          ]
        },
        {
          "names": [
            "Niklaus Schiess"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2016-6519",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2016-09-09T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1375147"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A cross-site scripting flaw was discovered in openstack-manila-ui\u0027s Metadata field contained in its \"Create Share\" form. A user could inject malicious HTML/JavaScript code that would then be reflected in the \"Shares\" overview. Remote, authenticated, but unprivileged users could exploit this vulnerability to steal session cookies and escalate their privileges.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openstack-manila-ui: persistent XSS in metadata field",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOS-9.0:openstack-manila-ui-0:2.1.0-2.el7ost.noarch",
          "7Server-RH7-RHOS-9.0:openstack-manila-ui-0:2.1.0-2.el7ost.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-6519"
        },
        {
          "category": "external",
          "summary": "RHBZ#1375147",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1375147"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-6519",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-6519"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6519",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6519"
        }
      ],
      "release_date": "2016-09-15T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-10-26T14:22:04+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-RH7-RHOS-9.0:openstack-manila-ui-0:2.1.0-2.el7ost.noarch",
            "7Server-RH7-RHOS-9.0:openstack-manila-ui-0:2.1.0-2.el7ost.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:2117"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOS-9.0:openstack-manila-ui-0:2.1.0-2.el7ost.noarch",
            "7Server-RH7-RHOS-9.0:openstack-manila-ui-0:2.1.0-2.el7ost.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openstack-manila-ui: persistent XSS in metadata field"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for openstack-manila-ui is now available for Red Hat OpenStack Platform 8.0 (Liberty).\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "OpenStack\u0027s File Share Service (manila) provides the means to easily provision shared file systems that can be consumed by multiple instances. These shared file systems are provisioned from pre-existing, back-end volumes. The UI component provides the dashboard plugin for the service.\n\nSecurity Fix(es):\n\n* A cross-site scripting flaw was discovered in openstack-manila-ui\u0027s Metadata field contained in its \"Create Share\" form. A user could inject malicious HTML/JavaScript code that would then be reflected in the \"Shares\" overview. Remote, authenticated, but unprivileged users could exploit this vulnerability to steal session cookies and escalate their privileges. (CVE-2016-6519)\n\nRed Hat would like to thank SUSE for reporting this issue. SUSE acknowledges Niklaus Schiess as the original reporter.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2016:2116",
        "url": "https://access.redhat.com/errata/RHSA-2016:2116"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "1375147",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1375147"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2116.json"
      }
    ],
    "title": "Red Hat Security Advisory: openstack-manila-ui security update",
    "tracking": {
      "current_release_date": "2025-11-21T17:58:04+00:00",
      "generator": {
        "date": "2025-11-21T17:58:04+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.12"
        }
      },
      "id": "RHSA-2016:2116",
      "initial_release_date": "2016-10-26T14:22:16+00:00",
      "revision_history": [
        {
          "date": "2016-10-26T14:22:16+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2016-10-26T14:22:16+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2025-11-21T17:58:04+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenStack Platform 8.0 (Liberty)",
                "product": {
                  "name": "Red Hat OpenStack Platform 8.0 (Liberty)",
                  "product_id": "7Server-RH7-RHOS-8.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openstack:8::el7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenStack Platform"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openstack-manila-ui-0:1.2.0-2.el7ost.noarch",
                "product": {
                  "name": "openstack-manila-ui-0:1.2.0-2.el7ost.noarch",
                  "product_id": "openstack-manila-ui-0:1.2.0-2.el7ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-manila-ui@1.2.0-2.el7ost?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openstack-manila-ui-0:1.2.0-2.el7ost.src",
                "product": {
                  "name": "openstack-manila-ui-0:1.2.0-2.el7ost.src",
                  "product_id": "openstack-manila-ui-0:1.2.0-2.el7ost.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-manila-ui@1.2.0-2.el7ost?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-manila-ui-0:1.2.0-2.el7ost.noarch as a component of Red Hat OpenStack Platform 8.0 (Liberty)",
          "product_id": "7Server-RH7-RHOS-8.0:openstack-manila-ui-0:1.2.0-2.el7ost.noarch"
        },
        "product_reference": "openstack-manila-ui-0:1.2.0-2.el7ost.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOS-8.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-manila-ui-0:1.2.0-2.el7ost.src as a component of Red Hat OpenStack Platform 8.0 (Liberty)",
          "product_id": "7Server-RH7-RHOS-8.0:openstack-manila-ui-0:1.2.0-2.el7ost.src"
        },
        "product_reference": "openstack-manila-ui-0:1.2.0-2.el7ost.src",
        "relates_to_product_reference": "7Server-RH7-RHOS-8.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "SUSE"
          ]
        },
        {
          "names": [
            "Niklaus Schiess"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2016-6519",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2016-09-09T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1375147"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A cross-site scripting flaw was discovered in openstack-manila-ui\u0027s Metadata field contained in its \"Create Share\" form. A user could inject malicious HTML/JavaScript code that would then be reflected in the \"Shares\" overview. Remote, authenticated, but unprivileged users could exploit this vulnerability to steal session cookies and escalate their privileges.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openstack-manila-ui: persistent XSS in metadata field",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOS-8.0:openstack-manila-ui-0:1.2.0-2.el7ost.noarch",
          "7Server-RH7-RHOS-8.0:openstack-manila-ui-0:1.2.0-2.el7ost.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-6519"
        },
        {
          "category": "external",
          "summary": "RHBZ#1375147",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1375147"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-6519",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-6519"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6519",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6519"
        }
      ],
      "release_date": "2016-09-15T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2016-10-26T14:22:16+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-RH7-RHOS-8.0:openstack-manila-ui-0:1.2.0-2.el7ost.noarch",
            "7Server-RH7-RHOS-8.0:openstack-manila-ui-0:1.2.0-2.el7ost.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:2116"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOS-8.0:openstack-manila-ui-0:1.2.0-2.el7ost.noarch",
            "7Server-RH7-RHOS-8.0:openstack-manila-ui-0:1.2.0-2.el7ost.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openstack-manila-ui: persistent XSS in metadata field"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for openstack-horizon-plugin-manila-ui",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "\nThis update for openstack-horizon-plugin-manila-ui fixes the\nmetadata_to_str function code injection vulnerability. (bsc#988935, CVE-2016-6519)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-OpenStack-Cloud-6-2016-1431",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2016_2457-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2016:2457-1",
        "url": "https://www.suse.com/support/update/announcement/2016/suse-su-20162457-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2016:2457-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2016-October/002308.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 988935",
        "url": "https://bugzilla.suse.com/988935"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-6519 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-6519/"
      }
    ],
    "title": "Security update for openstack-horizon-plugin-manila-ui",
    "tracking": {
      "current_release_date": "2016-10-05T07:33:52Z",
      "generator": {
        "date": "2016-10-05T07:33:52Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2016:2457-1",
      "initial_release_date": "2016-10-05T07:33:52Z",
      "revision_history": [
        {
          "date": "2016-10-05T07:33:52Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openstack-horizon-plugin-manila-ui-1.2.1~a0~dev2-3.1.noarch",
                "product": {
                  "name": "openstack-horizon-plugin-manila-ui-1.2.1~a0~dev2-3.1.noarch",
                  "product_id": "openstack-horizon-plugin-manila-ui-1.2.1~a0~dev2-3.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "python-horizon-plugin-manila-ui-1.2.1~a0~dev2-3.1.noarch",
                "product": {
                  "name": "python-horizon-plugin-manila-ui-1.2.1~a0~dev2-3.1.noarch",
                  "product_id": "python-horizon-plugin-manila-ui-1.2.1~a0~dev2-3.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE OpenStack Cloud 6",
                "product": {
                  "name": "SUSE OpenStack Cloud 6",
                  "product_id": "SUSE OpenStack Cloud 6",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:suse-openstack-cloud:6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-horizon-plugin-manila-ui-1.2.1~a0~dev2-3.1.noarch as component of SUSE OpenStack Cloud 6",
          "product_id": "SUSE OpenStack Cloud 6:openstack-horizon-plugin-manila-ui-1.2.1~a0~dev2-3.1.noarch"
        },
        "product_reference": "openstack-horizon-plugin-manila-ui-1.2.1~a0~dev2-3.1.noarch",
        "relates_to_product_reference": "SUSE OpenStack Cloud 6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-horizon-plugin-manila-ui-1.2.1~a0~dev2-3.1.noarch as component of SUSE OpenStack Cloud 6",
          "product_id": "SUSE OpenStack Cloud 6:python-horizon-plugin-manila-ui-1.2.1~a0~dev2-3.1.noarch"
        },
        "product_reference": "python-horizon-plugin-manila-ui-1.2.1~a0~dev2-3.1.noarch",
        "relates_to_product_reference": "SUSE OpenStack Cloud 6"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2016-6519",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-6519"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Cross-site scripting (XSS) vulnerability in the \"Shares\" overview in Openstack Manila before 2.5.1 allows remote authenticated users to inject arbitrary web script or HTML via the Metadata field in the \"Create Share\" form.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE OpenStack Cloud 6:openstack-horizon-plugin-manila-ui-1.2.1~a0~dev2-3.1.noarch",
          "SUSE OpenStack Cloud 6:python-horizon-plugin-manila-ui-1.2.1~a0~dev2-3.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-6519",
          "url": "https://www.suse.com/security/cve/CVE-2016-6519"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 988935 for CVE-2016-6519",
          "url": "https://bugzilla.suse.com/988935"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE OpenStack Cloud 6:openstack-horizon-plugin-manila-ui-1.2.1~a0~dev2-3.1.noarch",
            "SUSE OpenStack Cloud 6:python-horizon-plugin-manila-ui-1.2.1~a0~dev2-3.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE OpenStack Cloud 6:openstack-horizon-plugin-manila-ui-1.2.1~a0~dev2-3.1.noarch",
            "SUSE OpenStack Cloud 6:python-horizon-plugin-manila-ui-1.2.1~a0~dev2-3.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2016-10-05T07:33:52Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-6519"
    }
  ]
}

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:openstack:7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "9DAA72A4-AC7D-4544-89D4-5B07961D5A95",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:openstack:8:*:*:*:*:*:*:*",
              "matchCriteriaId": "E8B8C725-34CF-4340-BE7B-37E58CF706D6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:redhat:openstack:9:*:*:*:*:*:*:*",
              "matchCriteriaId": "F40C26BE-56CB-4022-A1D8-3CA0A8F87F4B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:openstack:manila:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4F6A85FE-13AF-495E-A434-87ED5AA65C80",
              "versionEndIncluding": "2.5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in the \"Shares\" overview in Openstack Manila before 2.5.1 allows remote authenticated users to inject arbitrary web script or HTML via the Metadata field in the \"Create Share\" form."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad XSS en la vista general de los \"Shares\" en Openstack Manila en versiones anteriores a 2.5.1 permite a usuarios no autenticados inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s del campo Metadata en el formulario \"Create Share\"."
    }
  ],
  "id": "CVE-2016-6519",
  "lastModified": "2025-04-20T01:37:25.860",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 3.5,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 6.8,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2017-04-21T15:59:00.537",
  "references": [
    {
      "source": "security@opentext.com",
      "url": "http://rhn.redhat.com/errata/RHSA-2016-2115.html"
    },
    {
      "source": "security@opentext.com",
      "url": "http://rhn.redhat.com/errata/RHSA-2016-2116.html"
    },
    {
      "source": "security@opentext.com",
      "url": "http://rhn.redhat.com/errata/RHSA-2016-2117.html"
    },
    {
      "source": "security@opentext.com",
      "url": "http://www.openwall.com/lists/oss-security/2016/09/15/7"
    },
    {
      "source": "security@opentext.com",
      "url": "http://www.securityfocus.com/bid/93001"
    },
    {
      "source": "security@opentext.com",
      "url": "https://bugs.launchpad.net/manila-ui/+bug/1597738"
    },
    {
      "source": "security@opentext.com",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1375147"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://rhn.redhat.com/errata/RHSA-2016-2115.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://rhn.redhat.com/errata/RHSA-2016-2116.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://rhn.redhat.com/errata/RHSA-2016-2117.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2016/09/15/7"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/93001"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugs.launchpad.net/manila-ui/+bug/1597738"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1375147"
    }
  ],
  "sourceIdentifier": "security@opentext.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

{
  "GSD": {
    "alias": "CVE-2016-6519",
    "description": "Cross-site scripting (XSS) vulnerability in the \"Shares\" overview in Openstack Manila before 2.5.1 allows remote authenticated users to inject arbitrary web script or HTML via the Metadata field in the \"Create Share\" form.",
    "id": "GSD-2016-6519",
    "references": [
      "https://www.suse.com/security/cve/CVE-2016-6519.html",
      "https://access.redhat.com/errata/RHSA-2016:2117",
      "https://access.redhat.com/errata/RHSA-2016:2116",
      "https://access.redhat.com/errata/RHSA-2016:2115"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2016-6519"
      ],
      "details": "Cross-site scripting (XSS) vulnerability in the \"Shares\" overview in Openstack Manila before 2.5.1 allows remote authenticated users to inject arbitrary web script or HTML via the Metadata field in the \"Create Share\" form.",
      "id": "GSD-2016-6519",
      "modified": "2023-12-13T01:21:23.498858Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security@microfocus.com",
        "ID": "CVE-2016-6519",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Cross-site scripting (XSS) vulnerability in the \"Shares\" overview in Openstack Manila before 2.5.1 allows remote authenticated users to inject arbitrary web script or HTML via the Metadata field in the \"Create Share\" form."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "RHSA-2016:2115",
            "refsource": "REDHAT",
            "url": "http://rhn.redhat.com/errata/RHSA-2016-2115.html"
          },
          {
            "name": "RHSA-2016:2117",
            "refsource": "REDHAT",
            "url": "http://rhn.redhat.com/errata/RHSA-2016-2117.html"
          },
          {
            "name": "RHSA-2016:2116",
            "refsource": "REDHAT",
            "url": "http://rhn.redhat.com/errata/RHSA-2016-2116.html"
          },
          {
            "name": "https://bugs.launchpad.net/manila-ui/+bug/1597738",
            "refsource": "CONFIRM",
            "url": "https://bugs.launchpad.net/manila-ui/+bug/1597738"
          },
          {
            "name": "93001",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/93001"
          },
          {
            "name": "[oss-security] 20160915 CVE-2016-6519: openstack-manila: Persistent XSS in Metadata field",
            "refsource": "MLIST",
            "url": "http://www.openwall.com/lists/oss-security/2016/09/15/7"
          },
          {
            "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1375147",
            "refsource": "CONFIRM",
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1375147"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:redhat:openstack:7.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:redhat:openstack:9:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:redhat:openstack:8:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:openstack:manila:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "2.5",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security@suse.com",
          "ID": "CVE-2016-6519"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Cross-site scripting (XSS) vulnerability in the \"Shares\" overview in Openstack Manila before 2.5.1 allows remote authenticated users to inject arbitrary web script or HTML via the Metadata field in the \"Create Share\" form."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-79"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1375147",
              "refsource": "CONFIRM",
              "tags": [
                "Issue Tracking",
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1375147"
            },
            {
              "name": "https://bugs.launchpad.net/manila-ui/+bug/1597738",
              "refsource": "CONFIRM",
              "tags": [
                "Issue Tracking",
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "https://bugs.launchpad.net/manila-ui/+bug/1597738"
            },
            {
              "name": "93001",
              "refsource": "BID",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "http://www.securityfocus.com/bid/93001"
            },
            {
              "name": "[oss-security] 20160915 CVE-2016-6519: openstack-manila: Persistent XSS in Metadata field",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "http://www.openwall.com/lists/oss-security/2016/09/15/7"
            },
            {
              "name": "RHSA-2016:2117",
              "refsource": "REDHAT",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "http://rhn.redhat.com/errata/RHSA-2016-2117.html"
            },
            {
              "name": "RHSA-2016:2116",
              "refsource": "REDHAT",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "http://rhn.redhat.com/errata/RHSA-2016-2116.html"
            },
            {
              "name": "RHSA-2016:2115",
              "refsource": "REDHAT",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "http://rhn.redhat.com/errata/RHSA-2016-2115.html"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 6.8,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "LOW",
          "userInteractionRequired": true
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          },
          "exploitabilityScore": 2.3,
          "impactScore": 2.7
        }
      },
      "lastModifiedDate": "2021-08-04T17:15Z",
      "publishedDate": "2017-04-21T15:59Z"
    }
  }
}

{
  "bids": {
    "bid": {
      "bidNumber": "93001"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2016-6519"
    }
  },
  "description": "OpenStack\u662f\u7f8e\u56fd\u56fd\u5bb6\u822a\u7a7a\u822a\u5929\u5c40\uff08National Aeronautics and Space Administration\uff09\u548c\u7f8e\u56fdRackspace\u516c\u53f8\u5408\u4f5c\u7814\u53d1\u7684\u4e00\u4e2a\u4e91\u5e73\u53f0\u7ba1\u7406\u9879\u76ee\u3002\r\n\r\nOpenStack manila\u4e2d\u5b58\u5728HTML\u6ce8\u5165\u6f0f\u6d1e\u3002\u7531\u4e8e\u7a0b\u5e8f\u672a\u80fd\u5145\u5206\u8fc7\u6ee4\u7528\u6237\u63d0\u4ea4\u7684\u8f93\u5165\u3002\u5f53\u7528\u6237\u6d4f\u89c8\u53d7\u5f71\u54cd\u7684\u7f51\u7ad9\u65f6\uff0c\u5176\u6d4f\u89c8\u5668\u5c06\u6267\u884c\u653b\u51fb\u8005\u63d0\u4f9b\u7684\u4efb\u610fHTML\u6216\u811a\u672c\u4ee3\u7801\u3002\u8fd9\u53ef\u80fd\u5bfc\u81f4\u653b\u51fb\u8005\u7a83\u53d6\u57fa\u4e8ecookie\u7684\u8eab\u4efd\u9a8c\u8bc1\u6216\u63a7\u5236\u7ad9\u70b9\u5448\u73b0\u7ed9\u7528\u6237\u7684\u65b9\u5f0f\u3002",
  "discovererName": "Niklaus Schiess",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u8be6\u60c5\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\uff1a\r\nhttp://www.openstack.org/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2016-07734",
  "openTime": "2016-09-20",
  "patchDescription": "OpenStack\u662f\u7f8e\u56fd\u56fd\u5bb6\u822a\u7a7a\u822a\u5929\u5c40\uff08National Aeronautics and Space Administration\uff09\u548c\u7f8e\u56fdRackspace\u516c\u53f8\u5408\u4f5c\u7814\u53d1\u7684\u4e00\u4e2a\u4e91\u5e73\u53f0\u7ba1\u7406\u9879\u76ee\u3002\r\n\r\nOpenStack manila\u4e2d\u5b58\u5728HTML\u6ce8\u5165\u6f0f\u6d1e\u3002\u7531\u4e8e\u7a0b\u5e8f\u672a\u80fd\u5145\u5206\u8fc7\u6ee4\u7528\u6237\u63d0\u4ea4\u7684\u8f93\u5165\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u6b64\u6f0f\u6d1e\u5728\u53d7\u5f71\u54cd\u7684\u7ad9\u70b9\u4e0a\u4e0b\u6587\u7684\u4fe1\u4efb\u7528\u6237\u6d4f\u89c8\u5668\u4e2d\u6267\u884c\u4efb\u610fHTML\u548c\u811a\u672c\u4ee3\u7801\uff0c\u7a83\u53d6\u57fa\u4e8ecookie\u7684\u8eab\u4efd\u9a8c\u8bc1\u5e76\u53d1\u8d77\u5176\u4ed6\u653b\u51fb\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "OpenStack manila HTML\u6ce8\u5165\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "OpenStack manila 0"
  },
  "referenceLink": "http://www.securityfocus.com/bid/93001",
  "serverity": "\u4e2d",
  "submitTime": "2016-09-19",
  "title": "OpenStack manila HTML\u6ce8\u5165\u6f0f\u6d1e"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "manila-ui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.5.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2016-6519"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-14T20:38:07Z",
    "nvd_published_at": "2017-04-21T15:59:00Z",
    "severity": "MODERATE"
  },
  "details": "Cross-site scripting (XSS) vulnerability in the \"Shares\" overview in Openstack Manila before 2.5.1 allows remote authenticated users to inject arbitrary web script or HTML via the Metadata field in the \"Create Share\" form.",
  "id": "GHSA-vq76-5ghr-9p4v",
  "modified": "2024-05-14T20:38:07Z",
  "published": "2022-05-13T01:07:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6519"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openstack/manila-ui/commit/009913d725bee34cef0bd62e47a298025ace2696"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openstack/manila-ui/commit/89593686ef18f2bd06223b92071b4be2362a5abd"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openstack/manila-ui/commit/fca19a1b0d42536644212c5d673fbd6866e67c43"
    },
    {
      "type": "WEB",
      "url": "https://bugs.launchpad.net/manila-ui/+bug/1597738"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1375147"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2016-2115.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2016-2116.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2016-2117.html"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2016/09/15/7"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/93001"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Openstack Manila Persistent XSS in Metadata field"
}