GitHub Advisoryadvisory · PyPI

GHSA-grm6-x6mr-q3cv OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability

MEDIUM Published 2022-05-13 Modified 2024-05-14 Official page ↗
Aliases
CVE-2016-4428
Ecosystem
PyPI
Packages
horizon
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-05-14

Affected packages

• PyPI horizon: < 8.0.2 → fixed in 8.0.2 • PyPI horizon: >= 9.0.0, < 9.1.0 → fixed in 9.1.0

Description

Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.

Related

Alias · CVE (1)

  • CVE-2016-4428 Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References