CVE-2015-3988

OpenStack Horizon 2015.1.0 - Authenticated Cross-Site Scripting via Metadata

Title source: llm
STIX 2.1

Description

Multiple cross-site scripting (XSS) vulnerabilities in OpenStack Dashboard (Horizon) 2015.1.0 allow remote authenticated users to inject arbitrary web script or HTML via the metadata to a (1) Glance image, (2) Nova flavor or (3) Host Aggregate.

References (6)

Core 6
Core References
Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2015/05/12/9
Various Sources x_refsource_confirm
https://security.openstack.org/ossa/OSSA-2015-009.html
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2015-1679.html
Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2015/05/14/14
Third Party Advisory vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/74666

Scores

EPSS 0.0035
EPSS Percentile 57.8%

Details

CWE
CWE-79
Status published
Products (2)
openstack/horizon 2015.1.0
oracle/solaris 11.2
Published May 19, 2015
Tracked Since Feb 18, 2026