CVE-2017-7400: OpenStack Horizon Cross-site Scripting (XSS) Vulnerability
Summary
CVE-2017-7400: OpenStack Horizon Cross-site Scripting (XSS). Affects horizon across 3 version ranges.
>= 9.0, < 9.1.2
>= 10.0, < 10.0.3
>= 11.0.0, < 11.0.1
Fixed in 9.1.2, 10.0.3 or 11.0.1, depending on the release line you run. How to fix ↓
Also tracked for
- horizon · Debian:11
The same CVE-2017-7400 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenStack Horizon is the web-based dashboard for OpenStack, allowing users to manage cloud resources through a user-friendly interface. It provides features such as project management, user management, and resource allocation. However, certain versions of Horizon are susceptible to Cross-site Scripting (XSS) attacks, which can compromise the security of the application and its users.
Vulnerability Detail
The vulnerability identified as CVE-2017-7400 affects OpenStack Horizon versions 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0. It allows remote authenticated administrators to conduct XSS attacks via a crafted federation mapping. This means that an attacker could inject malicious scripts into the application, which could then be executed in the context of another user's session, potentially leading to data theft or unauthorized actions.
How To Fix
Latest published version: 27.0.0 as of 22 Oct 2026
pip install --upgrade "horizon==27.0.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 9.0, < 9.1.29.1.2pip install --upgrade "horizon==9.1.2" -
>= 10.0, < 10.0.310.0.3pip install --upgrade "horizon==10.0.3" -
>= 11.0.0, < 11.0.111.0.1pip install --upgrade "horizon==11.0.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can restrict access to the Horizon dashboard to trusted users only, minimizing the risk of exploitation until the package can be updated.
Conclusion
The CVE-2017-7400 vulnerability in OpenStack Horizon poses a significant risk due to its potential for XSS attacks. It is crucial for administrators to update to the patched versions of Horizon to protect their applications and users from potential exploitation.
See every vulnerability recorded for horizon →
FAQ
XSS is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially compromising their data and session.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Consequences can include data theft, session hijacking, and unauthorized actions performed on behalf of the user, leading to significant security breaches.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the Pipfile.lock.
The CVSS score for this vulnerability is 4.8, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for horizon.
