XSS Vulnerability in Horizon Package: OpenStack Dashboard Risk
Summary
CVE-2014-3473: Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when us... Affects horizon versions < 2014.1.1-3. Fixed in 2014.1.1-3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Horizon is the web-based dashboard for OpenStack, allowing users to manage cloud resources through a user-friendly interface. It provides functionalities such as launching instances, managing networks, and handling storage. However, prior versions of Horizon are susceptible to a cross-site scripting (XSS) vulnerability, which can be exploited by malicious users to inject harmful scripts into the application.
Vulnerability Detail
The vulnerability, identified as CVE-2014-3473, arises from improper handling of Orchestration templates in the Horizon dashboard. When used with Heat, the dashboard allows remote template owners to inject arbitrary web scripts or HTML into the application. This can lead to unauthorized actions being performed on behalf of users, data theft, or other malicious activities. The affected versions include Horizon prior to 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2.
How To Fix
Minimum fixed version
2014.1.1-3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade horizonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider restricting access to the Orchestration/Stack section of the Horizon dashboard to trusted users only. This can help mitigate the risk of exploitation until a proper fix is applied.
Conclusion
CVE-2014-3473 represents a significant security risk for users of the Horizon dashboard in OpenStack. It is crucial to upgrade to a secure version to protect against potential exploitation. Additionally, utilizing tools like Vulert can help monitor for vulnerabilities in your software.
See every vulnerability recorded for horizon →
FAQ
CVE-2014-3473 is a cross-site scripting vulnerability in the Horizon dashboard of OpenStack, allowing attackers to inject malicious scripts.
Affected versions include Horizon before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
Exploitation of this vulnerability can lead to unauthorized actions, data theft, and other malicious activities performed on behalf of users.
Yes, restrict access to the Orchestration/Stack section of the Horizon dashboard to trusted users to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for horizon.
