Security readout for executives and security teams
Plain-English summary
This is an authenticated cross-site scripting issue in yanheven console. A remote user with required access could cause script content to run in a console user's browser through the availability zones table. The public record names a patch, but affected versions are not specified.
Executive priority
Handle as a moderate-priority hygiene fix. Escalate if the console is internet-accessible or broadly available to authenticated users. The business risk is browser-side trust abuse, not direct server takeover based on the supplied evidence.
Technical view
CVE-2014-125070 is CWE-79 in get_zone_hosts/AvailabilityZonesTable within openstack_dashboard/dashboards/admin/aggregates/tables.py. CVSS v2 is 4.0: network reachable, low complexity, single authentication required, no confidentiality impact, partial integrity impact, no availability impact.
Likely exposure
Exposure is limited to organizations running yanheven console, especially installations where authenticated users can access the affected OpenStack dashboard administration availability zones view. The source bundle lists versions as n/a, so version-based scoping is incomplete.
Exploitation context
The source bundle says the attack can be launched remotely and requires authentication per the CVSS vector. KEV is false, and the provided sources do not show active exploitation or a public exploit being used in the wild.
Researcher notes
Evidence is sparse: affected versions are not identified, and the CVE cites a patch commit rather than release guidance. Focus research on source comparison around AvailabilityZonesTable/get_zone_hosts and confirm whether deployed builds contain the patch.
Mitigation direction
- Apply the referenced patch commit ba908ae88d5925f4f6783eb234cc4ea95017472b.
- Check vendor or upstream guidance for affected-version details.
- Limit access to the administrative console to trusted authenticated users.
- Review maintained forks for equivalent output-escaping fixes.
Validation and detection
- Inventory whether yanheven console is deployed anywhere.
- Confirm the referenced patch commit or equivalent fix is present.
- Review access controls for the affected admin dashboard area.
- Check whether local forks include openstack_dashboard/dashboards/admin/aggregates/tables.py.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2014-125070 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4 (2.0)
- Known Exploited
- No
- Published
Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
AV:N/AC:L/Au:S/C:N/I:P/A:N82.9Primary CVE scoreVulnerability scoring details
Base CVSS 2.0 score
4MediumVector: AV:N/AC:L/Au:S/C:N/I:P/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://vuldb.com/?id.217651CVE reference · vdb-entry, technical-description
- https://vuldb.com/?ctiid.217651CVE reference · signature, permissions-required
- https://github.com/yanheven/console/commit/ba908ae88d5925f4f6783eb234cc4ea95017472bCVE reference · patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.