Launchpad.net

CVE 2014-3474

Cross-site scripting (XSS) vulnerability in horizon/static/horizon/js/horizon.instances.js in the Launch Instance menu in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to inject arbitrary web script or HTML via a network name.

Related bugs and status

CVE-2014-3474 (Candidate) is related to these bugs:

Bug #1322197: [OSSA 2014-023] Persistent XSS in OpenStack Havana UI for Network Name (CVE-2014-3474)

		In	Importance	Status
1322197	[OSSA 2014-023] Persistent XSS in OpenStack Havana UI for Network Name (CVE-2014-3474)	OpenStack Dashboard (Horizon)	High	Fix Released
1322197	[OSSA 2014-023] Persistent XSS in OpenStack Havana UI for Network Name (CVE-2014-3474)	OpenStack Security Advisory	High	Fix Released
1322197	[OSSA 2014-023] Persistent XSS in OpenStack Havana UI for Network Name (CVE-2014-3474)	OpenStack Dashboard (Horizon) icehouse	Undecided	Fix Released
1322197	[OSSA 2014-023] Persistent XSS in OpenStack Havana UI for Network Name (CVE-2014-3474)	OpenStack Dashboard (Horizon) havana	Undecided	Fix Released

Bug #1354159: [SRU] icehouse 2014.1.2 point release

		In	Importance	Status
1354159	[SRU] icehouse 2014.1.2 point release	nova (Ubuntu)	Undecided	Invalid
1354159	[SRU] icehouse 2014.1.2 point release	cinder (Ubuntu)	Undecided	Invalid
1354159	[SRU] icehouse 2014.1.2 point release	glance (Ubuntu)	Undecided	Invalid
1354159	[SRU] icehouse 2014.1.2 point release	ceilometer (Ubuntu)	Undecided	Invalid
1354159	[SRU] icehouse 2014.1.2 point release	heat (Ubuntu)	Undecided	Invalid
1354159	[SRU] icehouse 2014.1.2 point release	horizon (Ubuntu)	Undecided	Invalid
1354159	[SRU] icehouse 2014.1.2 point release	keystone (Ubuntu)	Undecided	Invalid
1354159	[SRU] icehouse 2014.1.2 point release	neutron (Ubuntu)	Undecided	Invalid
1354159	[SRU] icehouse 2014.1.2 point release	openstack-trove (Ubuntu)	Undecided	Won't Fix
1354159	[SRU] icehouse 2014.1.2 point release	ceilometer (Ubuntu Trusty)	Undecided	Fix Released
1354159	[SRU] icehouse 2014.1.2 point release	cinder (Ubuntu Trusty)	Undecided	Fix Released
1354159	[SRU] icehouse 2014.1.2 point release	glance (Ubuntu Trusty)	Undecided	Fix Released
1354159	[SRU] icehouse 2014.1.2 point release	heat (Ubuntu Trusty)	Undecided	Fix Released
1354159	[SRU] icehouse 2014.1.2 point release	horizon (Ubuntu Trusty)	Undecided	Fix Released
1354159	[SRU] icehouse 2014.1.2 point release	keystone (Ubuntu Trusty)	Undecided	Fix Released
1354159	[SRU] icehouse 2014.1.2 point release	neutron (Ubuntu Trusty)	Undecided	Fix Released
1354159	[SRU] icehouse 2014.1.2 point release	nova (Ubuntu Trusty)	Undecided	Fix Released
1354159	[SRU] icehouse 2014.1.2 point release	openstack-trove (Ubuntu Trusty)	Undecided	Won't Fix

Bug #1892848: XSS in adding JavaScript into the ‘Subnet Name’ field

Summary				In	Importance	Status
	1892848	XSS in adding JavaScript into the ‘Subnet Name’ field		OpenStack Security Advisory	Undecided	Incomplete
	1892848	XSS in adding JavaScript into the ‘Subnet Name’ field		OpenStack Dashboard (Horizon)	Undecided	Incomplete

See the

CVE page on Mitre.org for more details.

Launchpad.net

CVE 2014-3474

Related bugs and status

Related bugs

References