CVEvulnerability
CVE-2013-6858
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2013-11-23
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Multiple cross-site scripting (XSS) vulnerabilities in OpenStack Dashboard (Horizon) 2013.2 and earlier allow local users to inject arbitrary web script or HTML via an instance name to (1) "Volumes" or (2) "Network Topology" page.
Affected configurations
• openstack horizon (>= 2013.1 <= 2013.2)
• opensuse opensuse 13.1
• canonical ubuntu linux 12.10
• canonical ubuntu linux 13.04
• canonical ubuntu linux 13.10
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://lists.opensuse.org/opensuse-updates/2015-01/msg00040.html Mailing List, Third Party Advisory
- http://secunia.com/advisories/55770 Third Party Advisory
- http://secunia.com/advisories/56117 Third Party Advisory
- http://www.securityfocus.com/bid/63787 Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-2062-1 Third Party Advisory
- https://bugs.launchpad.net/horizon/+bug/1247675 Issue Tracking, Patch, Third Party Advisory
- http://lists.opensuse.org/opensuse-updates/2015-01/msg00040.html Mailing List, Third Party Advisory
- http://secunia.com/advisories/55770 Third Party Advisory
- http://secunia.com/advisories/56117 Third Party Advisory
- http://www.securityfocus.com/bid/63787 Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-2062-1 Third Party Advisory
- https://bugs.launchpad.net/horizon/+bug/1247675 Issue Tracking, Patch, Third Party Advisory