GitHub Advisory DatabaseGHSA-47VP-44V9-RHGQOpenStack Horizon Cross-site Scripting (XSS)
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:S/C:N/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
AI Score
Confidence
High
EPSS
Percentile
44.2%
OpenStack Horizon 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0 allows remote authenticated administrators to conduct XSS attacks via a crafted federation mapping.
Affected configurations
| Vendor | Product | Version | CPE |
|---|---|---|---|
| horizon_project | horizon | * | cpe:2.3:a:horizon_project:horizon:*:*:*:*:*:*:*:* |
References
www.securityfocus.com/bid/97324
access.redhat.com/errata/RHSA-2017:1598
access.redhat.com/errata/RHSA-2017:1739
github.com/advisories/GHSA-47vp-44v9-rhgq
launchpad.net/bugs/1667086
nvd.nist.gov/vuln/detail/CVE-2017-7400
opendev.org/openstack/horizon/commit/1407cfe53144146b29679de21f28c952282043ae
opendev.org/openstack/horizon/commit/511b325b45b6bd7a88bb6df1a4639b80d0121277
opendev.org/openstack/horizon/commit/a835dbfbaa2c70329c08d4b8429d49315dc6d651
opendev.org/openstack/horizon/commit/ce80bb6fec3cb0262728e7ae8b9d695cf832e5bf
Related
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:S/C:N/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
AI Score
Confidence
High
EPSS
Percentile
44.2%