CVE-2014-3474: openstack horizon Cross-site Scripting
Vulnerability summary
CVE-2014-3474 is a low (CVSS 3.5) Cross-site Scripting vulnerability in openstack horizon. EPSS estimates a 1.93% chance of exploitation in the next 30 days, higher than 79.7% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 3 · Related 1Timeline
- 31-10-2014PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Cross-site scripting (XSS) vulnerability in horizon/static/horizon/js/horizon.instances.js in the Launch Instance menu in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to inject arbitrary web script or HTML via a network name.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
1.93%
Chance of exploitation in the next 30 days
Percentile
80%
Versus all other CVEs
30-day change
0.00 pp
From 1.93% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (bugs.launchpad.net)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian1 product
- horizon< 2014.1.1-3
Openstack1 product
- horizon≥ 2013.2, < 2013.2.4 | ≥ 2014.1, < 2014.1.2 | juno-1
Opensuse1 product
- opensuseEOL13.1
PyPI1 product
- horizon< 8.0.0a0
Ubuntu1 product
- horizon< 1:2014.1.2-0ubuntu1
5 vendors · 5 products
References
22 links- bugs.launchpad.net/horizon/+bug/1322197X Refsource CONFIRMExploitIssue TrackingThird Party AdvisoryWEB
- lists.opensuse.org/opensuse-updates/2015-01/msg00040.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party AdvisoryWEB
Show all 22 references
- pypi.org/project/horizonPACKAGE
