Detections
Analytics

CVE-2020-26943

medium

Description

An issue was discovered in OpenStack blazar-dashboard before 1.3.1, 2.0.0, and 3.0.0. A user allowed to access the Blazar dashboard in Horizon may trigger code execution on the Horizon host as the user the Horizon service runs under (because the Python eval function is used). This may result in Horizon host unauthorized access and further compromise of the Horizon service. All setups using the Horizon dashboard with the blazar-dashboard plugin are affected.

References

https://security.openstack.org/ossa/OSSA-2020-007.html

https://review.opendev.org/756064

https://review.opendev.org/755814

https://review.opendev.org/755813

https://review.opendev.org/755812

https://review.opendev.org/755810

https://launchpad.net/bugs/1895688

http://www.openwall.com/lists/oss-security/2020/10/16/5

Details

Source: Mitre, NVD

Published: 2020-10-16

Updated: 2026-06-17

Risk Information

CVSS v2

Base Score: 9

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 9.9

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Severity: Critical

CVSS v4

Base Score: 6.5

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H

Severity: Medium

EPSS

EPSS: 0.01515