CVE-2014-0157

2014-04-1514:55:04

CWE-79

redhat

web.nvd.nist.gov

cve-2014-0157

xss

vulnerability

openstack

horizon

dashboard

nvd

security

web script

html

heat template

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.5

Confidence

High

EPSS

0.002

Percentile

60.3%

JSON

Cross-site scripting (XSS) vulnerability in the Horizon Orchestration dashboard in OpenStack Dashboard (aka Horizon) 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to inject arbitrary web script or HTML via the description field of a Heat template.

Affected configurations

Nvd

Node

openstackhorizonMatch2013.2

openstackhorizonMatch2013.2.1

openstackhorizonMatch2013.2.2

openstackhorizonMatch2013.2.3

Node

opensuseopensuseMatch13.1

VendorProductVersionCPE
openstackhorizon2013.2cpe:2.3:a:openstack:horizon:2013.2:*:*:*:*:*:*:*
openstackhorizon2013.2.1cpe:2.3:a:openstack:horizon:2013.2.1:*:*:*:*:*:*:*
openstackhorizon2013.2.2cpe:2.3:a:openstack:horizon:2013.2.2:*:*:*:*:*:*:*
openstackhorizon2013.2.3cpe:2.3:a:openstack:horizon:2013.2.3:*:*:*:*:*:*:*
opensuseopensuse13.1cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
openstack	horizon	2013.2	cpe:2.3:a:openstack:horizon:2013.2:::::::*
openstack	horizon	2013.2.1	cpe:2.3:a:openstack:horizon:2013.2.1:::::::*
openstack	horizon	2013.2.2	cpe:2.3:a:openstack:horizon:2013.2.2:::::::*
openstack	horizon	2013.2.3	cpe:2.3:a:openstack:horizon:2013.2.3:::::::*
opensuse	opensuse	13.1	cpe:2.3:o:opensuse:opensuse:13.1:::::::*