6.1

CVE-2020-29565: debian debian_linux Open Redirect

CVSS: 6.1v3.1MediumModified
AliasesSUSE-SU-2021:0099-1GHSA-f8fh-xp28-q59mPYSEC-2020-45
Published 04-12-2020Last modified 04-08-2024
Open JSON

Vulnerability summary

CVE-2020-29565 is a medium (CVSS 6.1) Open Redirect vulnerability in debian debian_linux. EPSS estimates a 1.43% chance of exploitation in the next 30 days, higher than 72.5% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
35/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.1/10
010
Medium · v3.1 (NVD)
EPSS score
1.43%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference

Timeline

  1. 04-12-2020
    PublishedVulnerability first disclosed.
  2. 04-08-2024
    Last modifiedVulnerability information updated.

Description

An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the "next" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL.

CVSS metrics

7 scores · 5 sources · 3 versions

EPSS trend

Probability

1.43%

Chance of exploitation in the next 30 days

Percentile

73%

Versus all other CVEs

30-day change

0.00 pp

From 1.43% on 18-09-2026

18-09-202618-10-2026
EPSS score
1.43%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (bugs.launchpad.net)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Suse6 products
  • openstack-dashboard&distro=HPE Helion OpenStack 8< 12.0.5~dev6-3.29.1
  • openstack-dashboard&distro=SUSE OpenStack Cloud 8< 12.0.5~dev6-3.29.1
  • openstack-dashboard&distro=SUSE OpenStack Cloud Crowbar 8< 12.0.5~dev6-3.29.1
  • release-notes-hpe-helion-openstack&distro=HPE Helion OpenStack 8< 8.20201214-3.26.1
  • release-notes-suse-openstack-cloud&distro=SUSE OpenStack Cloud 8< 8.20201214-3.26.1
Redhat3 products
  • openstack-dashboard< 1:16.2.1-1.20201114033610.el8ost | < 1:13.0.3-7.el7ost
  • python-django-horizon< 1:16.2.1-1.20201114033610.el8ost | < 1:13.0.3-7.el7ost
  • python3-django-horizon< 1:16.2.1-1.20201114033610.el8ost
Debian2 products
  • horizon< 3:18.6.1-1 | < 3:14.0.2-3+deb10u2
  • debian_linuxEOL10.0
Openstack1 product
  • horizon≥ 15.3.0, < 15.3.2 | ≥ 16.0.0, < 16.2.1 | ≥ 17.0.0, < 18.3.3 | ≥ 18.4.0, ≤ 18.5.0
PyPI1 product
  • horizon< 15.3.2 | ≥ 16.0.0, < 16.2.1 | ≥ 17.0.0, < 18.3.3 | ≥ 18.4.0, < 18.6.0
Ubuntu1 product
  • horizon< 2:9.1.2-0ubuntu5.2 | < 3:13.0.3-0ubuntu2 | < 3:18.3.2-0ubuntu0.20.04.4

6 vendors · 14 products

References

31 links
Show all 31 references