CVE-2016-4428

5.4MEDIUM

Key Information

Vendor
Openstack
Status
Horizon
Vendor
CVE Published:
12 July 2016

Summary

Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.

References

https://access.redhat.com/errata/RHSA-2016:1268
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2016:1270
vendor-advisoryx_refsource_REDHAT
http://www.debian.org/security/2016/dsa-3617
vendor-advisoryx_refsource_DEBIAN

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database
.