CVE-2017-7400 — Cross-site Scripting in Horizon

CWE-79 — Cross-site Scripting9 documents7 sources
Severity
4.8MEDIUMNVD
EPSS
0.2%
top 55.02%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Openstack Horizon
Timeline
PublishedApr 3
Latest updateMay 14

Description

OpenStack Horizon 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0 allows remote authenticated administrators to conduct XSS attacks via a crafted federation mapping.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NExploitability: 1.7 | Impact: 2.7

Affected Packages1 packages

▶NVDopenstack/horizon8 versions+7

🔴Vulnerability Details

4
GHSA
OpenStack Horizon Cross-site Scripting (XSS)↗2022-05-14
▶
OSV
OpenStack Horizon Cross-site Scripting (XSS)↗2022-05-14
▶
CVEList
CVE-2017-7400: OpenStack Horizon 9↗2017-04-03
▶
OSV
CVE-2017-7400: OpenStack Horizon 9↗2017-04-03
▶

📋Vendor Advisories

2
Red Hat
python-django-horizon: XSS in federation mappings UI↗2017-03-03
▶
Debian
CVE-2017-7400: horizon - OpenStack Horizon 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0 allows remo...↗2017
▶

💬Community

2
Bugzilla
CVE-2017-7400 python-django-horizon: XSS in federation mappings UI [openstack-rdo]↗2017-04-21
▶
Bugzilla
CVE-2017-7400 python-django-horizon: XSS in federation mappings UI↗2017-04-06
▶
CVE-2017-7400 — Cross-site Scripting in Horizon | cvebase