CVE-2014-0157

2014-04-1514:55:04

CWE-79

[email protected]

web.nvd.nist.gov

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.5

Confidence

High

EPSS

0.002

Percentile

60.3%

JSON

Cross-site scripting (XSS) vulnerability in the Horizon Orchestration dashboard in OpenStack Dashboard (aka Horizon) 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to inject arbitrary web script or HTML via the description field of a Heat template.

Affected configurations

Nvd

Node

openstackhorizonMatch2013.2

openstackhorizonMatch2013.2.1

openstackhorizonMatch2013.2.2

openstackhorizonMatch2013.2.3

Node

opensuseopensuseMatch13.1

VendorProductVersionCPE
openstackhorizon2013.2cpe:2.3:a:openstack:horizon:2013.2:*:*:*:*:*:*:*
openstackhorizon2013.2.1cpe:2.3:a:openstack:horizon:2013.2.1:*:*:*:*:*:*:*
openstackhorizon2013.2.2cpe:2.3:a:openstack:horizon:2013.2.2:*:*:*:*:*:*:*
openstackhorizon2013.2.3cpe:2.3:a:openstack:horizon:2013.2.3:*:*:*:*:*:*:*
opensuseopensuse13.1cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
openstack	horizon	2013.2	cpe:2.3:a:openstack:horizon:2013.2:::::::*
openstack	horizon	2013.2.1	cpe:2.3:a:openstack:horizon:2013.2.1:::::::*
openstack	horizon	2013.2.2	cpe:2.3:a:openstack:horizon:2013.2.2:::::::*
openstack	horizon	2013.2.3	cpe:2.3:a:openstack:horizon:2013.2.3:::::::*
opensuse	opensuse	13.1	cpe:2.3:o:opensuse:opensuse:13.1:::::::*