CVE-2016-4428 OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability
MediumCVSS 5.4
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi horizon(PyPI) | < 8.0.2 | 8.0.2 |
| pypi horizon(PyPI) | >= 9.0.0, < 9.1.0 | 9.1.0 |
| pypi horizon(PyPI) | <= 8.0.1 | No fix listed |
| pypi horizon(PyPI) | >= 9.0.0, <= 9.0.1 | No fix listed |
| debian/horizon(Debian:12) | < 3:9.0.1-2 | 3:9.0.1-2 |
| debian/horizon(Debian:13) | < 3:9.0.1-2 | 3:9.0.1-2 |
| debian/horizon(Debian:14) | < 3:9.0.1-2 | 3:9.0.1-2 |
| OpenStack horizon | >= 8.0.0, <= 8.0.1 | No fix listed |
| OpenStack horizon | = 9.0.0 | No fix listed |
| OpenStack horizon | = 9.0.1 | No fix listed |
| redhat openstack | = 6.0 | No fix listed |
| redhat openstack | = 7.0 | No fix listed |
| redhat openstack | = 8 | No fix listed |
| redhat openstack | = 5.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- RHSA-2016:1268 third-party-advisory vendor-advisory
- RHSA-2016:1269 third-party-advisory vendor-advisory
- RHSA-2016:1270 third-party-advisory vendor-advisory
- RHSA-2016:1271 third-party-advisory vendor-advisory
- RHSA-2016:1272 third-party-advisory vendor-advisory
- access.redhat.com
- bugs.launchpad.net issue-tracking third-party-advisory
- bugzilla.redhat.com
- review.openstack.org patch vendor-advisory
- review.openstack.org patch vendor-advisory
- review.openstack.org patch vendor-advisory
- security.openstack.org patch vendor-advisory
- DSA-3617 third-party-advisory vendor-advisory
- [oss-security] 20160617 [OSSA-2016-010] XSS in Horizon client side template (CVE-2016-4428) mailing-list patch third-party-advisory
- pypi.org product
- github.com vendor-advisory
- Debian Security Tracker CVE-2016-4428 vendor-advisory
- bugs.debian.org issue-tracking