CVE-2025-56537

Vulnerability

Overview

CVE-2025-2025-56537 is a stored cross-site scripting (XSS) vulnerability in OpenNebula 6.10.0.1 and earlier versions allows an attacker to inject arbitrary web scripts or HTML via a crafted payload into the virtual network template parameter [1][2]. The vulnerability resides in the opennebula-sunstone component, which is the web-based user interface for OpenNebula [2].

Exploitation

An attacker with access to create or modify virtual network templates can inject a malicious payload, such as <image src =q onerror=prompt(8)> into the template parameter [2]. When an administrator or administrator views the affected template in the Sunstone interface, the injected script executes in the context of their browser session [2]. No authentication bypass is required, but the attacker must have privileges to edit virtual network templates [2].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser session [1][2]. This can lead to session hijacking, defacement, or theft of sensitive information displayed in the Sunstone interface [2]. The CVSS v3 score of 6.1 (Medium) reflects the need for user interaction and the potential for partial impact on confidentiality and integrity [1].

Mitigation

The vulnerability is fixed in OpenNebula version 7.0 (Phoenix) and later [1][2]. Users running OpenNebula 6.10.0.1 or earlier should upgrade to version 7.0 or newer to remediate the issue [1][2]. No workarounds are documented in the available references.