<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">CVE-2016-6519</DocumentTitle>
  <DocumentType>SUSE CVE</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE CVE-2016-6519</ID>
    </Identification>
    <Status>Interim</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>10</Number>
        <Date>2022-09-25T00:27:45Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2021-05-30T13:44:50Z</InitialReleaseDate>
    <CurrentReleaseDate>2022-09-25T00:27:45Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf-cve.pl</Engine>
      <Date>2020-12-27T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="CVE" Type="Summary" Ordinal="1" xml:lang="en">CVE-2016-6519</Note>
    <Note Title="Mitre CVE Description" Type="Description" Ordinal="2" xml:lang="en">Cross-site scripting (XSS) vulnerability in the "Shares" overview in Openstack Manila before 2.5.1 allows remote authenticated users to inject arbitrary web script or HTML via the Metadata field in the "Create Share" form.</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="4" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
  </DocumentNotes>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://lists.suse.com/pipermail/sle-security-updates/2016-October/002308.html</URL>
      <Description>E-Mail link for SUSE-SU-2016:2457-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="SUSE Cloud 5">
      <Branch Type="Product Name" Name="SUSE Cloud 5">
        <FullProductName ProductID="SUSE Cloud 5" CPE="cpe:/a:suse:suse-cloud:5">SUSE Cloud 5</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Cloud for SLE 12 Compute Nodes">
      <Branch Type="Product Name" Name="SUSE Cloud for SLE 12 Compute Nodes">
        <FullProductName ProductID="SUSE Cloud for SLE 12 Compute Nodes" CPE="cpe:/o:suse:suse-sle12-cloud-compute:5">SUSE Cloud for SLE 12 Compute Nodes</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE OpenStack Cloud 6">
      <Branch Type="Product Name" Name="SUSE OpenStack Cloud 6">
        <FullProductName ProductID="SUSE OpenStack Cloud 6" CPE="cpe:/o:suse:suse-openstack-cloud:6">SUSE OpenStack Cloud 6</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="openstack-horizon-plugin-manila-ui-1.2.1~a0~dev2-3.1">
      <FullProductName ProductID="openstack-horizon-plugin-manila-ui-1.2.1~a0~dev2-3.1">openstack-horizon-plugin-manila-ui-1.2.1~a0~dev2-3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="openstack-manila">
      <FullProductName ProductID="openstack-manila">openstack-manila</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="openstack-manila-api">
      <FullProductName ProductID="openstack-manila-api">openstack-manila-api</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="openstack-manila-scheduler">
      <FullProductName ProductID="openstack-manila-scheduler">openstack-manila-scheduler</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="openstack-manila-share">
      <FullProductName ProductID="openstack-manila-share">openstack-manila-share</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="python-horizon-plugin-manila-ui-1.2.1~a0~dev2-3.1">
      <FullProductName ProductID="python-horizon-plugin-manila-ui-1.2.1~a0~dev2-3.1">python-horizon-plugin-manila-ui-1.2.1~a0~dev2-3.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="python-manila">
      <FullProductName ProductID="python-manila">python-manila</FullProductName>
    </Branch>
    <Relationship ProductReference="openstack-horizon-plugin-manila-ui-1.2.1~a0~dev2-3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud 6">
      <FullProductName ProductID="SUSE OpenStack Cloud 6:openstack-horizon-plugin-manila-ui-1.2.1~a0~dev2-3.1">openstack-horizon-plugin-manila-ui-1.2.1~a0~dev2-3.1 as a component of SUSE OpenStack Cloud 6</FullProductName>
    </Relationship>
    <Relationship ProductReference="python-horizon-plugin-manila-ui-1.2.1~a0~dev2-3.1" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud 6">
      <FullProductName ProductID="SUSE OpenStack Cloud 6:python-horizon-plugin-manila-ui-1.2.1~a0~dev2-3.1">python-horizon-plugin-manila-ui-1.2.1~a0~dev2-3.1 as a component of SUSE OpenStack Cloud 6</FullProductName>
    </Relationship>
    <Relationship ProductReference="openstack-manila" RelationType="Default Component Of" RelatesToProductReference="SUSE Cloud 5">
      <FullProductName ProductID="SUSE Cloud 5:openstack-manila">openstack-manila as a component of SUSE Cloud 5</FullProductName>
    </Relationship>
    <Relationship ProductReference="openstack-manila" RelationType="Default Component Of" RelatesToProductReference="SUSE Cloud for SLE 12 Compute Nodes">
      <FullProductName ProductID="SUSE Cloud for SLE 12 Compute Nodes:openstack-manila">openstack-manila as a component of SUSE Cloud for SLE 12 Compute Nodes</FullProductName>
    </Relationship>
    <Relationship ProductReference="openstack-manila" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud 6">
      <FullProductName ProductID="SUSE OpenStack Cloud 6:openstack-manila">openstack-manila as a component of SUSE OpenStack Cloud 6</FullProductName>
    </Relationship>
    <Relationship ProductReference="openstack-manila-api" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud 6">
      <FullProductName ProductID="SUSE OpenStack Cloud 6:openstack-manila-api">openstack-manila-api as a component of SUSE OpenStack Cloud 6</FullProductName>
    </Relationship>
    <Relationship ProductReference="openstack-manila-scheduler" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud 6">
      <FullProductName ProductID="SUSE OpenStack Cloud 6:openstack-manila-scheduler">openstack-manila-scheduler as a component of SUSE OpenStack Cloud 6</FullProductName>
    </Relationship>
    <Relationship ProductReference="openstack-manila-share" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud 6">
      <FullProductName ProductID="SUSE OpenStack Cloud 6:openstack-manila-share">openstack-manila-share as a component of SUSE OpenStack Cloud 6</FullProductName>
    </Relationship>
    <Relationship ProductReference="python-manila" RelationType="Default Component Of" RelatesToProductReference="SUSE OpenStack Cloud 6">
      <FullProductName ProductID="SUSE OpenStack Cloud 6:python-manila">python-manila as a component of SUSE OpenStack Cloud 6</FullProductName>
    </Relationship>
  </ProductTree>
  <Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Cross-site scripting (XSS) vulnerability in the "Shares" overview in Openstack Manila before 2.5.1 allows remote authenticated users to inject arbitrary web script or HTML via the Metadata field in the "Create Share" form.</Note>
    </Notes>
    <CVE>CVE-2016-6519</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE OpenStack Cloud 6:openstack-horizon-plugin-manila-ui-1.2.1~a0~dev2-3.1</ProductID>
        <ProductID>SUSE OpenStack Cloud 6:python-horizon-plugin-manila-ui-1.2.1~a0~dev2-3.1</ProductID>
      </Status>
      <Status Type="Known Not Affected">
        <ProductID>SUSE Cloud 5:openstack-manila</ProductID>
        <ProductID>SUSE Cloud for SLE 12 Compute Nodes:openstack-manila</ProductID>
        <ProductID>SUSE OpenStack Cloud 6:openstack-manila</ProductID>
        <ProductID>SUSE OpenStack Cloud 6:openstack-manila-api</ProductID>
        <ProductID>SUSE OpenStack Cloud 6:openstack-manila-scheduler</ProductID>
        <ProductID>SUSE OpenStack Cloud 6:openstack-manila-share</ProductID>
        <ProductID>SUSE OpenStack Cloud 6:python-manila</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:S/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>5.4</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
  </Vulnerability>
</cvrfdoc>
