CVE-2014-3473

Опубликовано: 31 окт. 2014

Источник: nvd

CVSS2: 4.3

EPSS Низкий

Описание

Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when used with Heat, allows remote Orchestration template owners or catalogs to inject arbitrary web script or HTML via a crafted template.

Ссылки

http://lists.opensuse.org/opensuse-updates/2015-01/msg00040.html
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/07/08/6
Mailing List
Patch
http://www.securityfocus.com/bid/68459
Third Party Advisory
VDB Entry
https://bugs.launchpad.net/horizon/+bug/1308727
Issue Tracking
Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2015-01/msg00040.html
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/07/08/6
Mailing List
Patch
http://www.securityfocus.com/bid/68459
Third Party Advisory
VDB Entry
https://bugs.launchpad.net/horizon/+bug/1308727
Issue Tracking
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:openstack:horizon:*:*:*:*:*:*:*:*

Версия от 2013.2 (включая) до 2013.2.4 (исключая)

cpe:2.3:a:openstack:horizon:*:*:*:*:*:*:*:*

Версия от 2014.1 (включая) до 2014.1.2 (исключая)

cpe:2.3:a:openstack:horizon:juno-1:*:*:*:*:*:*:*

Конфигурация 2

cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*

EPSS

Процентиль: 60%

0.004

Низкий

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

CVE-2014-3473

ubuntu

больше 11 лет назад

CVE-2014-3473

redhat

больше 11 лет назад

CVE-2014-3473

debian

больше 11 лет назад

Cross-site scripting (XSS) vulnerability in the Orchestration/Stack se ...

GHSA-8vwv-2v7v-jmgr

github

больше 3 лет назад

Horizon-Orchestration Cross-site scripting (XSS) vulnerability through resource name

EPSS

Процентиль: 60%

0.004

Низкий

4.3 Medium

CVSS2

Дефекты

CWE-79