{"id":"CVE-2016-6519","aliases":["DEBIAN-CVE-2016-6519","EUVD-2022-5403","GHSA-vq76-5ghr-9p4v","PYSEC-2026-662","RHSA-2016:2115","RHSA-2016:2116","RHSA-2016:2117","SUSE-SU-2016:2457-1","UBUNTU-CVE-2016-6519"],"status":"published","title":"Openstack Manila Persistent XSS in Metadata field","description":"Cross-site scripting (XSS) vulnerability in the \"Shares\" overview in Openstack Manila before 2.5.1 allows remote authenticated users to inject arbitrary web script or HTML via the Metadata field in the \"Create Share\" form.","severity":{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01474,"percentile":0.7399,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2016-10-05T07:33:52Z","modified":"2026-09-22T07:00:24Z","fixes":[{"ecosystem":"PyPI","package":"manila-ui","fixed_in":["2.5.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"manila-ui","fixed_in":["2.5.1-0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"manila-ui","fixed_in":["2.5.1-0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"manila-ui","fixed_in":["2.5.1-0"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"openstack-manila-ui","fixed_in":["0:1.0.1-3.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:8::el7","package":"openstack-manila-ui","fixed_in":["0:1.2.0-2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:9::el7","package":"openstack-manila-ui","fixed_in":["0:2.1.0-2.el7ost"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-horizon-plugin-manila-ui","fixed_in":["1.2.1~a0~dev2-3.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"manila-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"manila-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"manila-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-0"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"manila-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1-0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"manila-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1"}]}],"versions":["0.1.0","1.0.0","1.0.1","1.1.0","1.2.0","2.0.0","2.1.0","2.2.0","2.3.0","2.4.0","2.5.0"]},{"source":"osv","ecosystem":"PyPI","package":"manila-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.1"}]}],"versions":["0.1.0","1.0.0","1.0.1","1.1.0","1.2.0","2.0.0","2.1.0","2.2.0","2.3.0","2.4.0","2.5.0"]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"openstack-manila-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.1-3.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:8::el7","package":"openstack-manila-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:9::el7","package":"openstack-manila-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.0-2.el7ost"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-horizon-plugin-manila-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1~a0~dev2-3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"manila-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.0-1"]}],"products":[{"vendor":"openstack","product":"manila"},{"vendor":"redhat","product":"openstack"}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2016-2115.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2117.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2116.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://bugs.launchpad.net/manila-ui/+bug/1597738","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/93001","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2016/09/15/7","tags":["mailing-list","x_refsource_MLIST","x_transferred","web","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1375147","tags":["x_refsource_CONFIRM","x_transferred","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6519","tags":["advisory"]},{"url":"https://github.com/openstack/manila-ui/commit/009913d725bee34cef0bd62e47a298025ace2696","tags":["web"]},{"url":"https://github.com/openstack/manila-ui/commit/89593686ef18f2bd06223b92071b4be2362a5abd","tags":["web"]},{"url":"https://github.com/openstack/manila-ui/commit/fca19a1b0d42536644212c5d673fbd6866e67c43","tags":["web"]},{"url":"https://github.com/advisories/GHSA-vq76-5ghr-9p4v","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-6519","tags":["advisory"]},{"url":"https://pypi.org/project/manila-ui","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2016:2115","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2115.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-6519","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6519","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2016:2116","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2116.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:2117","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2117.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162457-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/988935","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6519","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-6519","tags":["report"]},{"url":"https://github.com/openstack/manila-ui/blob/d5fe23e4ba30846acdd09fa1dc61a415016a7e26/manila_ui/dashboards/project/shares/shares/tabs.py#L49","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-6519","description":"Cross-site scripting (XSS) vulnerability in the \"Shares\" overview in Openstack Manila before 2.5.1 allows remote authenticated users to inject arbitrary web script or HTML via the Metadata field in the \"Create Share\" form.","status":"published","published":"2017-04-21T15:00:00Z","modified":"2024-08-06T01:29:20.32Z","updated_at":"2026-11-02T14:33:34.443637Z"}],"euvd":[{"id":"EUVD-2022-5403","description":"Cross-site scripting (XSS) vulnerability in the \"Shares\" overview in Openstack Manila before 2.5.1 allows remote authenticated users to inject arbitrary web script or HTML via the Metadata field in the \"Create Share\" form.","status":"published","published":"2017-04-21T15:00:00Z","modified":"2024-08-06T01:29:20Z","updated_at":"2026-11-03T02:22:36.370031Z"}],"ghsa":[{"id":"GHSA-vq76-5ghr-9p4v","title":"Openstack Manila Persistent XSS in Metadata field","description":"Cross-site scripting (XSS) vulnerability in the \"Shares\" overview in Openstack Manila before 2.5.1 allows remote authenticated users to inject arbitrary web script or HTML via the Metadata field in the \"Create Share\" form.","status":"published","published":"2022-05-13T01:07:29Z","modified":"2024-05-14T20:38:08Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:48.848211Z"}],"nvd":[{"id":"CVE-2016-6519","description":"Cross-site scripting (XSS) vulnerability in the \"Shares\" overview in Openstack Manila before 2.5.1 allows remote authenticated users to inject arbitrary web script or HTML via the Metadata field in the \"Create Share\" form.","status":"published","published":"2017-04-21T15:59:00.537Z","modified":"2026-06-17T00:51:18.87Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:03:37.619685Z"}],"osv":[{"id":"CVE-2016-6519","description":"Cross-site scripting (XSS) vulnerability in the \"Shares\" overview in Openstack Manila before 2.5.1 allows remote authenticated users to inject arbitrary web script or HTML via the Metadata field in the \"Create Share\" form.","status":"published","published":"2017-04-21T15:59:00.537Z","modified":"2026-07-06T08:11:18.042108636Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:02.776224Z"},{"id":"DEBIAN-CVE-2016-6519","description":"Cross-site scripting (XSS) vulnerability in the \"Shares\" overview in Openstack Manila before 2.5.1 allows remote authenticated users to inject arbitrary web script or HTML via the Metadata field in the \"Create Share\" form.","status":"published","published":"2017-04-21T15:59:00.537Z","modified":"2026-09-22T07:00:24.791719398Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:27.910042Z"},{"id":"GHSA-vq76-5ghr-9p4v","title":"Openstack Manila Persistent XSS in Metadata field","description":"Cross-site scripting (XSS) vulnerability in the \"Shares\" overview in Openstack Manila before 2.5.1 allows remote authenticated users to inject arbitrary web script or HTML via the Metadata field in the \"Create Share\" form.","status":"published","published":"2022-05-13T01:07:29Z","modified":"2026-07-06T08:11:18.042108636Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:57.694388Z"},{"id":"PYSEC-2026-662","title":"Openstack Manila Persistent XSS in Metadata field","description":"Cross-site scripting (XSS) vulnerability in the \"Shares\" overview in Openstack Manila before 2.5.1 allows remote authenticated users to inject arbitrary web script or HTML via the Metadata field in the \"Create Share\" form.","status":"published","published":"2026-07-02T14:13:22.326003Z","modified":"2026-07-06T08:00:43.506576405Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:57.671918Z"},{"id":"RHSA-2016:2115","title":"Red Hat Security Advisory: openstack-manila-ui security update","status":"published","published":"2024-09-13T14:37:37Z","modified":"2026-06-29T10:14:11Z","cvss":[{"version":"3.0","score":4.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:2116","title":"Red Hat Security Advisory: openstack-manila-ui security update","status":"published","published":"2024-09-13T14:37:31Z","modified":"2026-06-29T10:14:11Z","cvss":[{"version":"3.0","score":4.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:2117","title":"Red Hat Security Advisory: openstack-manila-ui security update","status":"published","published":"2024-09-13T14:37:25Z","modified":"2026-06-29T10:14:12Z","cvss":[{"version":"3.0","score":4.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"UBUNTU-CVE-2016-6519","description":"Cross-site scripting (XSS) vulnerability in the \"Shares\" overview in Openstack Manila before 2.5.1 allows remote authenticated users to inject arbitrary web script or HTML via the Metadata field in the \"Create Share\" form.","status":"published","published":"2017-04-21T15:59:00Z","modified":"2025-10-24T04:45:51Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:12.642042Z"},{"id":"SUSE-SU-2016:2457-1","title":"Security update for openstack-horizon-plugin-manila-ui","description":"\nThis update for openstack-horizon-plugin-manila-ui fixes the\nmetadata_to_str function code injection vulnerability. (bsc#988935, CVE-2016-6519)\n","status":"published","published":"2016-10-05T07:33:52Z","modified":"2025-05-02T04:05:28.605572Z","updated_at":"2026-11-02T15:53:43.438985Z"}]}}