OpenStack Horizon-Orchestration Cross-site scripting (XSS) vulnerability
Summary
CVE-2014-3473: Horizon-Orchestration Cross-site scripting (XSS) vulnerability through resource name. Affects horizon versions < 8.0.0a0. Fixed in 8.0.0a0. How to fix ↓
Also tracked for
- horizon · Debian:11
The same CVE-2014-3473 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenStack Dashboard (Horizon) is an open-source web-based interface for managing and monitoring OpenStack clouds. It provides a graphical user interface (GUI) for administrators, operators, and users to interact with various OpenStack services. Horizon includes the Orchestration module, which allows users to create and manage stacks of resources using Heat, the OpenStack Orchestration service. However, a vulnerability has been identified in the Orchestration/Stack section of Horizon, which could allow remote attackers to inject arbitrary web script or HTML via a crafted template.
Vulnerability Detail
The vulnerability, identified as CVE-2014-3473, is a cross-site scripting (XSS) vulnerability in the Horizon Orchestration dashboard. It affects versions of OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 when used with Heat. The vulnerability can be exploited by remote Orchestration template owners or catalogs who can inject malicious web script or HTML code into the resource name field. This can lead to various security risks, including session hijacking, data theft, and unauthorized actions within the Horizon dashboard.
How To Fix
Latest published version: 27.0.0 as of 22 Oct 2026
pip install --upgrade "horizon==27.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8.0.0a0
This is the first release that contains the fix.
pip install --upgrade "horizon==8.0.0a0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The OpenStack Horizon-Orchestration XSS vulnerability poses a moderate security risk to users of affected versions. It is crucial to upgrade to a fixed version of Horizon to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for horizon →
FAQ
The vulnerability allows remote attackers to inject arbitrary web script or HTML into the Horizon Orchestration dashboard, potentially leading to session hijacking, data theft, and unauthorized actions.
Users of OpenStack Dashboard (Horizon) versions before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when used with Heat, are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your Horizon installation is affected by this vulnerability. Simply upload your Pipfile.lock to the playground, and it will provide real-time monitoring and alerts for open-source vulnerabilities.
No specific workaround has been provided for this vulnerability. It is recommended to upgrade to a fixed version of Horizon.
You can find more information about this vulnerability in the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-8vwv-2v7v-jmgr/GHSA-8vwv-2v7v-jmgr.json
References
Related vulnerabilities
Recent vulnerabilities recorded for horizon.
