CVE-2016-4428
Fixed in a distro release EPSS 2%
Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.
Products: openstack horizon, redhat openstack, debian_linux
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | horizon | 8.0.2 |
| PyPI | horizon | 9.1.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | horizon | 3:9.0.1-2 |
| Debian 13 | horizon | 3:9.0.1-2 |
| Debian 14 | horizon | 3:9.0.1-2 |
| Debian 7 | horizon | 2012.1.1-10+deb7u1 |
| Debian 8 | horizon | 2014.1.3-7+deb8u2 |
| Red Hat openstack 5 | openstack-dashboard | 0:2014.1.5-4.el6ost |
| Red Hat openstack 5 | openstack-dashboard | 0:2014.1.5-4.el7ost |
| Red Hat openstack 5 | openstack-dashboard-theme | 0:2014.1.5-4.el6ost |
| Red Hat openstack 5 | openstack-dashboard-theme | 0:2014.1.5-4.el7ost |
| Red Hat openstack 5 | python-django-horizon | 0:2014.1.5-4.el7ost |
| Red Hat openstack 5 | python-django-horizon | 0:2014.1.5-4.el6ost |
| Red Hat openstack 5 | python-django-horizon-doc | 0:2014.1.5-4.el7ost |
| Red Hat openstack 5 | python-django-horizon-doc | 0:2014.1.5-4.el6ost |
| Red Hat openstack 6 | openstack-dashboard | 0:2014.2.3-9.el7ost |
| Red Hat openstack 6 | openstack-dashboard-theme | 0:2014.2.3-9.el7ost |
| Red Hat openstack 6 | python-django-horizon | 0:2014.2.3-9.el7ost |
| Red Hat openstack 6 | python-django-horizon-doc | 0:2014.2.3-9.el7ost |
| Red Hat openstack 7 | openstack-dashboard | 0:2015.1.4-1.el7ost |
| Red Hat openstack 7 | openstack-dashboard-theme | 0:2015.1.4-1.el7ost |
| Red Hat openstack 7 | python-django-horizon | 0:2015.1.4-1.el7ost |
| Red Hat openstack 7 | python-django-horizon-doc | 0:2015.1.4-1.el7ost |
| Red Hat openstack 8 | openstack-dashboard | 1:8.0.1-4.el7ost |
| Red Hat openstack 8 | openstack-dashboard-theme | 1:8.0.1-4.el7ost |
| Red Hat openstack 8 | python-django-horizon | 1:8.0.1-4.el7ost |
| SUSE OpenStack Cloud 6 | openstack-ceilometer | 5.0.4~a0~dev6-6.1 |
| SUSE OpenStack Cloud 6 | openstack-ceilometer-doc | 5.0.4~a0~dev6-6.2 |
| SUSE OpenStack Cloud 6 | openstack-cinder | 7.0.3~a0~dev2-7.1 |
| SUSE OpenStack Cloud 6 | openstack-cinder-doc | 7.0.3~a0~dev2-7.1 |
| SUSE OpenStack Cloud 6 | openstack-dashboard | 8.0.2~a0~dev34-8.1 |
| SUSE OpenStack Cloud 6 | openstack-glance | 11.0.2~a0~dev13-7.1 |
| SUSE OpenStack Cloud 6 | openstack-glance-doc | 11.0.2~a0~dev13-7.1 |
| SUSE OpenStack Cloud 6 | openstack-heat | 5.0.2~a0~dev93-9.1 |
| SUSE OpenStack Cloud 6 | openstack-heat-doc | 5.0.2~a0~dev93-9.3 |
| SUSE OpenStack Cloud 6 | openstack-keystone | 8.1.1~a0~dev13-3.1 |
| SUSE OpenStack Cloud 6 | openstack-keystone-doc | 8.1.1~a0~dev13-3.2 |
| SUSE OpenStack Cloud 6 | openstack-manila | 1.0.2~a0~dev11-9.1 |
| SUSE OpenStack Cloud 6 | openstack-manila-doc | 1.0.2~a0~dev11-9.2 |
| SUSE OpenStack Cloud 6 | openstack-neutron | 7.1.2~a0~dev29-10.1 |
| SUSE OpenStack Cloud 6 | openstack-neutron-doc | 7.1.2~a0~dev29-10.1 |
| SUSE OpenStack Cloud 6 | openstack-neutron-fwaas | 7.1.2~a0~dev1-6.1 |
| SUSE OpenStack Cloud 6 | openstack-neutron-fwaas-doc | 7.1.2~a0~dev1-6.1 |
| SUSE OpenStack Cloud 6 | openstack-neutron-lbaas | 7.1.2~a0~dev1-6.1 |
| SUSE OpenStack Cloud 6 | openstack-neutron-lbaas-doc | 7.1.2~a0~dev1-6.1 |
| SUSE OpenStack Cloud 6 | openstack-nova | 12.0.5~a0~dev2-7.1 |
| SUSE OpenStack Cloud 6 | openstack-nova-doc | 12.0.5~a0~dev2-7.1 |
| SUSE OpenStack Cloud 6 | openstack-resource-agents | 1.0+git.1467079370.4f2c49d-7.1 |
| SUSE OpenStack Cloud 6 | python-networking-cisco | 2.1.1-6.1 |
| SUSE OpenStack Cloud 6 | python-openstackclient | 1.7.2-4.1 |
| Ubuntu 14.04 LTS | horizon | 1:2014.1.5-0ubuntu2.1 |