OpenStack Horizon Cross-site scripting (XSS) vulnerability in horizon
Summary
CVE-2014-3474: OpenStack Horizon Cross-site scripting (XSS) vulnerability. Affects horizon versions < 8.0.0a0. Fixed in 8.0.0a0. How to fix ↓
Also tracked for
- horizon · Debian:11
The same CVE-2014-3474 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenStack Horizon is the web-based dashboard interface for managing OpenStack services. It provides a graphical user interface (GUI) for users to interact with OpenStack resources and perform various operations. The Horizon package, available on PyPI, is responsible for the frontend functionality of the dashboard. However, an XSS vulnerability has been identified in the Launch Instance menu of Horizon, allowing remote authenticated users to inject arbitrary web script or HTML via a network name.
Vulnerability Detail
The vulnerability exists in the horizon/static/horizon/js/horizon.instances.js file within the Launch Instance menu. It allows authenticated users to exploit a cross-site scripting (XSS) vulnerability by injecting malicious web script or HTML code through the network name field. This can lead to the execution of arbitrary code within the context of the affected user's browser, potentially compromising their session or exposing sensitive information. The vulnerability has been assigned the identifier CVE-2014-3474.
How To Fix
Latest published version: 27.0.0 as of 22 Oct 2026
pip install --upgrade "horizon==27.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8.0.0a0
This is the first release that contains the fix.
pip install --upgrade "horizon==8.0.0a0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the Horizon package is not immediately feasible, a temporary workaround is to disable the Launch Instance menu or restrict access to it for authenticated users. This can be achieved by modifying the Horizon configuration or applying access control rules at the network level. However, it is strongly advised to apply the official fix as soon as possible.
Conclusion
The OpenStack Horizon XSS vulnerability in the Launch Instance menu poses a risk to authenticated users who can inject malicious web script or HTML code through the network name field. To mitigate this vulnerability, it is crucial to update the Horizon package to version 8.0.0a0 or later. If immediate updating is not possible, applying access control rules or disabling the Launch Instance menu can serve as temporary workarounds. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for horizon →
FAQ
OpenStack Horizon is the web-based dashboard interface for managing OpenStack services. It provides a graphical user interface (GUI) for users to interact with OpenStack resources and perform various operations.
Cross-site scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to the execution of arbitrary code within the context of the affected user's browser, potentially compromising their session or exposing sensitive information.
The OpenStack Horizon XSS vulnerability can be exploited by authenticated users who have access to the Launch Instance menu. By injecting malicious web script or HTML code through the network name field, an attacker can execute arbitrary code within the context of the affected user's browser.
The OpenStack Horizon XSS vulnerability can allow attackers to execute arbitrary code within the context of a user's browser. This can lead to session hijacking, unauthorized access to sensitive information, or the manipulation of user interface elements.
To protect your OpenStack Horizon installation from this vulnerability, it is recommended to update the Horizon package to version 8.0.0a0 or later. Additionally, you can apply access control rules to restrict access to the Launch Instance menu or disable it temporarily if updating is not immediately feasible.
References
Related vulnerabilities
Recent vulnerabilities recorded for horizon.
