Every CVE Search/ Get API key

CVE-2014-3473

Horizon-Orchestration Cross-site scripting (XSS) vulnerability through resource name

4.3 MediumFix available

Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when used with Heat, allows remote Orchestration template owners or catalogs to inject arbitrary web script or HTML via a crafted template.

Exploit likelihood

1.70%Up 0.7 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.3

Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when used with Heat, allows remote Orchestration template owners or catalogs to inject arbitrary web script or HTML via a crafted template.

Record
CVE-2014-3473
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE List No score

Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when used with Heat, allows remote Orchestration template owners or catalogs to inject arbitrary web script or HTML via a crafted template.

Record
CVE-2014-3473
Updated
2026-11-02
EUVDEUVD-2022-3247 No score

Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when used with Heat, allows remote Orchestration template owners or catalogs to inject arbitrary web script or HTML via a crafted template.

Record
EUVD-2022-3247
Updated
2026-11-03
GitHub AdvisoriesGHSA-8vwv-2v7v-jmgr No score

Horizon-Orchestration Cross-site scripting (XSS) vulnerability through resource name

Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when used with Heat, allows remote Orchestration template owners or catalogs to inject arbitrary web script or HTML via a crafted template.

Record
GHSA-8vwv-2v7v-jmgr
Weakness
CWE-79
Updated
2026-11-02
OSV No score

Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when used with Heat, allows remote Orchestration template owners or catalogs to inject arbitrary web script or HTML via a crafted template.

Record
CVE-2014-3473
Updated
2026-11-02
OSVDEBIAN-CVE-2014-3473 No score

Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when used with Heat, allows remote Orchestration template owners or catalogs to inject arbitrary web script or HTML via a crafted template.

Record
DEBIAN-CVE-2014-3473
Updated
2026-11-02
Show 4 moreShow less
OSVGHSA-8vwv-2v7v-jmgr No score

Horizon-Orchestration Cross-site scripting (XSS) vulnerability through resource name

Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when used with Heat, allows remote Orchestration template owners or catalogs to inject arbitrary web script or HTML via a crafted template.

Record
GHSA-8vwv-2v7v-jmgr
Weakness
CWE-79
Updated
2026-11-02
OSVPYSEC-2026-642 No score

Horizon-Orchestration Cross-site scripting (XSS) vulnerability through resource name

Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when used with Heat, allows remote Orchestration template owners or catalogs to inject arbitrary web script or HTML via a crafted template.

Record
PYSEC-2026-642
Updated
2026-11-02
OSVUBUNTU-CVE-2014-3473 No score

Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when used with Heat, allows remote Orchestration template owners or catalogs to inject arbitrary web script or HTML via a crafted template.

Record
UBUNTU-CVE-2014-3473
Updated
2026-11-02
OSVUSN-2323-1 No score

horizon vulnerabilities

Jason Hullinger discovered that OpenStack Horizon did not properly perform input sanitization on Heat templates. If a user were tricked into using a specially crafted Heat template, an attacker could conduct cross-site scripting attacks. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. (CVE-2014-3473)

Craig Lorentzen discovered that OpenStack Horizon did not properly perform input sanitization when creating networks. If a user were tricked into launching an image using the crafted network name, an attacker could conduct cross-site scripting attacks. (CVE-2014-3474)

Michael Xin discovered that OpenStack Horizon did not properly perform input sanitization when adding users. If an admin user were tricked into viewing the users page containing a crafted email address, an attacker could conduct cross-site scripting attacks. (CVE-2014-3475)

Dennis Felsch and Mario Heiderich discovered that OpenStack Horizon did not properly perform input sanitization when creating host aggregates. If an admin user were tricked into viewing the Host Aggregates page containing a crafted availability zone name, an attacker could conduct cross-site scripting attacks. (CVE-2014-3594)

Record
USN-2323-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
horizon
PyPI
 before 8.0.0a0
8.0.0a0
horizon
Debian:12
 before 2014.1.1-3
2014.1.1-3
horizon
Debian:13
 before 2014.1.1-3
2014.1.1-3
horizon
Debian:14
 before 2014.1.1-3
2014.1.1-3
openstack-dashboard
Red Hat:openstack:5::el7
 before 0:2014.1.1-2.el7ost
0:2014.1.1-2.el7ost
openstack-dashboard-theme
Red Hat:openstack:5::el7
 before 0:2014.1.1-2.el7ost
0:2014.1.1-2.el7ost
python-django-horizon
Red Hat:openstack:5::el7
 before 0:2014.1.1-2.el7ost
0:2014.1.1-2.el7ost
python-django-horizon-doc
Red Hat:openstack:5::el7
 before 0:2014.1.1-2.el7ost
0:2014.1.1-2.el7ost
openstack-dashboard
Red Hat:openstack:4::el6
 before 0:2013.2.3-3.el6ost
0:2013.2.3-3.el6ost
openstack-dashboard-theme
Red Hat:openstack:4::el6
 before 0:2013.2.3-3.el6ost
0:2013.2.3-3.el6ost
Show 4 moreShow less
Affected packages
PackageAffectedFixed
python-django-horizon
Red Hat:openstack:4::el6
 before 0:2013.2.3-3.el6ost
0:2013.2.3-3.el6ost
python-django-horizon-doc
Red Hat:openstack:4::el6
 before 0:2013.2.3-3.el6ost
0:2013.2.3-3.el6ost
horizon
Ubuntu:14.04:LTS
 before 1:2014.1.2-0ubuntu1, plus listed versions
1:2013.2~rc3-0ubuntu11:2013.2-0ubuntu11:2014.1~b1-0ubuntu11:2014.1~b2-0ubuntu11:2014.1~b2-0ubuntu2
Show 6 moreShow less
1:2014.1~b3-0ubuntu11:2014.1~b3-0ubuntu21:2014.1~rc1-0ubuntu11:2014.1~rc2-0ubuntu11:2014.1-0ubuntu11:2014.1.1-0ubuntu1
1:2014.1.2-0ubuntu1
horizon
Ubuntu:14.04:LTS
 before 1:2014.1.2-0ubuntu1.1, plus listed versions
1:2013.2~rc3-0ubuntu11:2013.2-0ubuntu11:2014.1~b1-0ubuntu11:2014.1~b2-0ubuntu11:2014.1~b2-0ubuntu2
Show 7 moreShow less
1:2014.1~b3-0ubuntu11:2014.1~b3-0ubuntu21:2014.1~rc1-0ubuntu11:2014.1~rc2-0ubuntu11:2014.1-0ubuntu11:2014.1.1-0ubuntu11:2014.1.2-0ubuntu1
1:2014.1.2-0ubuntu1.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-3473 is a medium vulnerability (CVSS 4.3) in Openstack Horizon, published July 9, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.70%, the 77th percentile. Fixed in horizon 8.0.0a0.

References

Show 34 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open