Red Hat Security Advisory 2014-0941-01 - OpenStack Object Storage provides object storage in virtual containers, which allows users to store and retrieve files. It was found that Swift did not escape all HTTP header values, allowing data to be injected into the responses sent from the Swift server. This could lead to cross-site scripting attacks if a user were tricked into clicking on a malicious URL.
d30f5bfd8905d8674b1d746649a38df392d90111e0b2c428837a01b20f20c092Ubuntu Security Notice 2256-1 - John Dickinson discovered that Swift did not properly quote the WWW-Authenticate header value. If a user were tricked into navigating to a malicious Swift URL, an attacker could conduct cross-site scripting attacks. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain.
852027970b4a45e5e99ddbaa1d4e1623c2a36639b5516a4ace71e95384748ddf
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed