CVE-2013-6858

OpenStack Horizon < 2013.2 - Cross-Site Scripting via Instance Name

Title source: llm
STIX 2.1

Description

Multiple cross-site scripting (XSS) vulnerabilities in OpenStack Dashboard (Horizon) 2013.2 and earlier allow local users to inject arbitrary web script or HTML via an instance name to (1) "Volumes" or (2) "Network Topology" page.

References (6)

Core 6
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/63787
Third Party Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2062-1
Issue Tracking, Patch, Third Party Advisory x_refsource_confirm
https://bugs.launchpad.net/horizon/+bug/1247675
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/55770
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2015-01/msg00040.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/56117

Scores

EPSS 0.0048
EPSS Percentile 65.2%

Details

CWE
CWE-79
Status published
Products (5)
canonical/ubuntu_linux 12.10
canonical/ubuntu_linux 13.04
canonical/ubuntu_linux 13.10
openstack/horizon 2013.1 - 2013.2
opensuse/opensuse 13.1
Published Nov 23, 2013
Tracked Since Feb 18, 2026