CVE-2014-8578
published 2014-10-31CVE-2014-8578: Cross-site scripting (XSS) vulnerability in the Groups panel in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2…
PriorityP414low3.5CVSS 2.0
AVNACMAuSCNIPAN
EPSS
1.18%
64.4th percentile
Cross-site scripting (XSS) vulnerability in the Groups panel in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-3475.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | horizon | < horizon 2014.1.1-3 (bookworm) | horizon 2014.1.1-3 (bookworm) |
| openstack | horizon | <= juno-1 | — |
| openstack | horizon | — | — |
| openstack | horizon | >= 0 < 2014.1.1-3 | 2014.1.1-3 |
| openstack | horizon | >= 0 < 2014.1.1-3 | 2014.1.1-3 |
| openstack | horizon | >= 0 < 2014.1.1-3 | 2014.1.1-3 |
| openstack | horizon | >= 0 < 2014.1.1-3 | 2014.1.1-3 |
| openstack | horizon | >= 2013.2 < 2013.2.4 | 2013.2.4 |
| openstack | horizon | >= 2014.1 < 2014.1.2 | 2014.1.2 |
| opensuse | opensuse | — | — |
CVSS provenance
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
osv3.5LOW
vendor_redhat4.3MEDIUM
vendor_debian3.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-grxx-9m9p-rf4j: Cross-site scripting (XSS) vulnerability in the Groups panel in OpenStack Dashboard (Horizon) before 2013
ghsa_unreviewed·2022-05-13·CVSS 3.5
CVE-2014-8578 [LOW] CWE-79 GHSA-grxx-9m9p-rf4j: Cross-site scripting (XSS) vulnerability in the Groups panel in OpenStack Dashboard (Horizon) before 2013
Cross-site scripting (XSS) vulnerability in the Groups panel in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-3475.
GHSA
GHSA-vw9p-vx37-72h4: Cross-site scripting (XSS) vulnerability in the Users panel (admin/users/) in OpenStack Dashboard (Horizon) before 2013
ghsa_unreviewed·2022-05-13·CVSS 3.5
CVE-2014-3475 [LOW] CWE-79 GHSA-vw9p-vx37-72h4: Cross-site scripting (XSS) vulnerability in the Users panel (admin/users/) in OpenStack Dashboard (Horizon) before 2013
Cross-site scripting (XSS) vulnerability in the Users panel (admin/users/) in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-8578.
OSV
CVE-2014-8578: Cross-site scripting (XSS) vulnerability in the Groups panel in OpenStack Dashboard (Horizon) before 2013
osv·2014-10-31·CVSS 3.5
CVE-2014-8578 [LOW] CVE-2014-8578: Cross-site scripting (XSS) vulnerability in the Groups panel in OpenStack Dashboard (Horizon) before 2013
Cross-site scripting (XSS) vulnerability in the Groups panel in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-3475.
OSV
CVE-2014-3475: Cross-site scripting (XSS) vulnerability in the Users panel (admin/users/) in OpenStack Dashboard (Horizon) before 2013
osv·2014-10-31·CVSS 3.5
CVE-2014-3475 [LOW] CVE-2014-3475: Cross-site scripting (XSS) vulnerability in the Users panel (admin/users/) in OpenStack Dashboard (Horizon) before 2013
Cross-site scripting (XSS) vulnerability in the Users panel (admin/users/) in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-8578.
Red Hat
openstack-horizon: multiple XSS flaws
vendor_redhat·2014-07-08·CVSS 4.3
CVE-2014-3475 [MEDIUM] CWE-79 openstack-horizon: multiple XSS flaws
openstack-horizon: multiple XSS flaws
Cross-site scripting (XSS) vulnerability in the Users panel (admin/users/) in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-8578.
A cross-site scripting (XSS) flaw was found in the way orchestration templates were handled. An owner of such a template could use this flaw to perform XSS attacks against other Horizon users. (CVE-2014-3473)
It was found that network names were not sanitized. A malicious user could use this flaw to perform XSS attacks against other Horizon users by creating a network with a specially-crafted name. (CVE-2014-3474)
It was found that some email a
Red Hat
openstack-horizon: multiple XSS flaws
vendor_redhat·2014-07-08·CVSS 4.3
CVE-2014-8578 [MEDIUM] CWE-79 openstack-horizon: multiple XSS flaws
openstack-horizon: multiple XSS flaws
Cross-site scripting (XSS) vulnerability in the Groups panel in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-3475.
A cross-site scripting (XSS) flaw was found in the way orchestration templates were handled. An owner of such a template could use this flaw to perform XSS attacks against other Horizon users. (CVE-2014-3473)
It was found that network names were not sanitized. A malicious user could use this flaw to perform XSS attacks against other Horizon users by creating a network with a specially-crafted name. (CVE-2014-3474)
It was found that some email addresses were
Debian
CVE-2014-8578: horizon - Cross-site scripting (XSS) vulnerability in the Groups panel in OpenStack Dashbo...
vendor_debian·2014·CVSS 3.5
CVE-2014-8578 [LOW] CVE-2014-8578: horizon - Cross-site scripting (XSS) vulnerability in the Groups panel in OpenStack Dashbo...
Cross-site scripting (XSS) vulnerability in the Groups panel in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-3475.
Scope: local
bookworm: resolved (fixed in 2014.1.1-3)
bullseye: resolved (fixed in 2014.1.1-3)
forky: resolved (fixed in 2014.1.1-3)
sid: resolved (fixed in 2014.1.1-3)
trixie: resolved (fixed in 2014.1.1-3)
Debian
CVE-2014-3475: horizon - Cross-site scripting (XSS) vulnerability in the Users panel (admin/users/) in Op...
vendor_debian·2014·CVSS 3.5
CVE-2014-3475 [LOW] CVE-2014-3475: horizon - Cross-site scripting (XSS) vulnerability in the Users panel (admin/users/) in Op...
Cross-site scripting (XSS) vulnerability in the Users panel (admin/users/) in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-8578.
Scope: local
bookworm: resolved (fixed in 2014.1.1-3)
bullseye: resolved (fixed in 2014.1.1-3)
forky: resolved (fixed in 2014.1.1-3)
sid: resolved (fixed in 2014.1.1-3)
trixie: resolved (fixed in 2014.1.1-3)
No detection rules found.
No public exploits indexed.
2014-10-31
Published