Cross-Site Scripting Vulnerability in OpenStack Dashboard by OpenStack
CVE-2016-4428

5.4MEDIUM

Key Information:

Vendor

Openstack
Status
Horizon
Vendor
CVE Published:
12 July 2016

What is CVE-2016-4428?

An XSS vulnerability in OpenStack Dashboard (Horizon) allows remote authenticated users to inject arbitrary web scripts or HTML via AngularJS templates within dashboard forms. This flaw could lead to unauthorized access or data manipulation, compromising the integrity of the affected application.

References

https://access.redhat.com/errata/RHSA-2016:1268
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2016:1270
vendor-advisoryx_refsource_REDHAT
http://www.debian.org/security/2016/dsa-3617
vendor-advisoryx_refsource_DEBIAN

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.