CVE-2014-3475

LOW 3.5CVE-2014-3475 · Published 31/10/2014 · updated 17/06/2026

In short

CVE-2014-3475 is a LOW (CVSS 3.5) vulnerability affecting horizon (openstack).
Chance of exploitation in the next 30 days (EPSS): 1.2%, higher than 69.0% of all vulnerabilities.
Fix: update to 2013.2.4, 2014.1.2 or later.

Package	Affected versions	Patched versions
horizon openstack	`= juno-1≥ 2013.2, < 2013.2.4≥ 2014.1, < 2014.1.2`	`2013.2.42014.1.2`

Description

Cross-site scripting (XSS) vulnerability in the Users panel (admin/users/) in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-8578.

References

lists.opensuse.org/opensuse-updates/2015-01/msg00040.html · Mailing List
openwall.com/lists/oss-security/2014/07/08/6 · Mailing List
securityfocus.com/bid/68456 · Third Party Advisory
bugs.launchpad.net/horizon/+bug/1320235 · Issue Tracking

More vulnerabilities in horizon

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

horizon

openstack

= juno-1≥ 2013.2, < 2013.2.4≥ 2014.1, < 2014.1.2

2013.2.42014.1.2

Description

More vulnerabilities in horizon

See all →