CVE-2014-0157 OpenStack Dashboard (aka Horizon) vulnerable to Cross-site Scripting
MediumCVSS 4.3
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in the Horizon Orchestration dashboard in OpenStack Dashboard (aka Horizon) 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to inject arbitrary web script or HTML via the description field of a Heat template.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi horizon(PyPI) | >= 2013.2, < 2013.2.4 | 2013.2.4 |
| debian/horizon(Debian:12) | < 2013.2.3-1 | 2013.2.3-1 |
| debian/horizon(Debian:13) | < 2013.2.3-1 | 2013.2.3-1 |
| debian/horizon(Debian:14) | < 2013.2.3-1 | 2013.2.3-1 |
| OpenStack horizon | = 2013.2 | No fix listed |
| OpenStack horizon | = 2013.2.1 | No fix listed |
| OpenStack horizon | = 2013.2.2 | No fix listed |
| OpenStack horizon | = 2013.2.3 | No fix listed |
| opensuse | = 13.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- access.redhat.com
- access.redhat.com
- bugzilla.redhat.com
- launchpad.net vendor-advisory
- opendev.org product
- web.archive.org
- openSUSE-SU-2015:0078 vendor-advisory
- [oss-security] 20140408 [OSSA 2014-010] XSS in Horizon orchestration dashboard (CVE-2014-0157) mailing-list patch
- pypi.org product
- github.com vendor-advisory
- Debian Security Tracker CVE-2014-0157 vendor-advisory
- 66706 vdb-entry
- bugs.debian.org issue-tracking