CVE-2020-26943: openstack blazar-dashboard
Vulnerability summary
CVE-2020-26943 is a critical (CVSS 9.9) vulnerability in openstack blazar-dashboard. EPSS estimates a 3.29% chance of exploitation in the next 30 days, higher than 88.3% of scored vulnerabilities.
Timeline
- 16-10-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in OpenStack blazar-dashboard before 1.3.1, 2.0.0, and 3.0.0. A user allowed to access the Blazar dashboard in Horizon may trigger code execution on the Horizon host as the user the Horizon service runs under (because the Python eval function is used). This may result in Horizon host unauthorized access and further compromise of the Horizon service. All setups using the Horizon dashboard with the blazar-dashboard plugin are affected.
CVSS metrics
4 scores · 2 sources · 3 versions- OSV · PypiEcosystem advisory · calculated9.9CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS trend
Probability
3.29%
Chance of exploitation in the next 30 days
Percentile
88%
Versus all other CVEs
30-day change
0.00 pp
From 3.29% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Openstack1 product
- blazar-dashboard< 1.3.1 | 2.0.0 | 3.0.0
PyPI1 product
- blazar-dashboard< 1.3.1 | ≥ 2.0.0, < 2.0.1 | ≥ 3.0.0, < 3.0.1
2 vendors · 2 products
References
11 links- www.openwall.com/lists/oss-security/2020/10/16/5Mailing ListX Refsource MLISTWEBThird Party Advisory
