Every CVE Search/ Get API key

CVE-2014-3474

OpenStack Horizon Cross-site scripting (XSS) vulnerability

3.5 LowFix available

Cross-site scripting (XSS) vulnerability in horizon/static/horizon/js/horizon.instances.js in the Launch Instance menu in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to inject arbitrary web script or HTML via a network name.

Exploit likelihood

1.93%Up 0.8 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 3.5

Cross-site scripting (XSS) vulnerability in horizon/static/horizon/js/horizon.instances.js in the Launch Instance menu in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to inject arbitrary web script or HTML via a network name.

Record
CVE-2014-3474
CVSS 2.0
3.5 LowAV:N/AC:M/Au:S/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE List No score

Cross-site scripting (XSS) vulnerability in horizon/static/horizon/js/horizon.instances.js in the Launch Instance menu in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to inject arbitrary web script or HTML via a network name.

Record
CVE-2014-3474
Updated
2026-11-02
EUVDEUVD-2022-4281 No score

Cross-site scripting (XSS) vulnerability in horizon/static/horizon/js/horizon.instances.js in the Launch Instance menu in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to inject arbitrary web script or HTML via a network name.

Record
EUVD-2022-4281
Updated
2026-11-03
GitHub AdvisoriesGHSA-j57p-g33w-95c5 No score

OpenStack Horizon Cross-site scripting (XSS) vulnerability

Cross-site scripting (XSS) vulnerability in horizon/static/horizon/js/horizon.instances.js in the Launch Instance menu in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to inject arbitrary web script or HTML via a network name.

Record
GHSA-j57p-g33w-95c5
Weakness
CWE-79
Updated
2026-11-02
OSV No score

Cross-site scripting (XSS) vulnerability in horizon/static/horizon/js/horizon.instances.js in the Launch Instance menu in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to inject arbitrary web script or HTML via a network name.

Record
CVE-2014-3474
Updated
2026-11-02
OSVDEBIAN-CVE-2014-3474 No score

Cross-site scripting (XSS) vulnerability in horizon/static/horizon/js/horizon.instances.js in the Launch Instance menu in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to inject arbitrary web script or HTML via a network name.

Record
DEBIAN-CVE-2014-3474
Updated
2026-11-02
Show 4 moreShow less
OSVGHSA-j57p-g33w-95c5 No score

OpenStack Horizon Cross-site scripting (XSS) vulnerability

Cross-site scripting (XSS) vulnerability in horizon/static/horizon/js/horizon.instances.js in the Launch Instance menu in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to inject arbitrary web script or HTML via a network name.

Record
GHSA-j57p-g33w-95c5
Weakness
CWE-79
Updated
2026-11-02
OSVPYSEC-2026-644 No score

OpenStack Horizon Cross-site scripting (XSS) vulnerability

Cross-site scripting (XSS) vulnerability in horizon/static/horizon/js/horizon.instances.js in the Launch Instance menu in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to inject arbitrary web script or HTML via a network name.

Record
PYSEC-2026-644
Updated
2026-11-02
OSVUBUNTU-CVE-2014-3474 No score

Cross-site scripting (XSS) vulnerability in horizon/static/horizon/js/horizon.instances.js in the Launch Instance menu in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to inject arbitrary web script or HTML via a network name.

Record
UBUNTU-CVE-2014-3474
Updated
2026-11-02
OSVUSN-2323-1 No score

horizon vulnerabilities

Jason Hullinger discovered that OpenStack Horizon did not properly perform input sanitization on Heat templates. If a user were tricked into using a specially crafted Heat template, an attacker could conduct cross-site scripting attacks. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. (CVE-2014-3473)

Craig Lorentzen discovered that OpenStack Horizon did not properly perform input sanitization when creating networks. If a user were tricked into launching an image using the crafted network name, an attacker could conduct cross-site scripting attacks. (CVE-2014-3474)

Michael Xin discovered that OpenStack Horizon did not properly perform input sanitization when adding users. If an admin user were tricked into viewing the users page containing a crafted email address, an attacker could conduct cross-site scripting attacks. (CVE-2014-3475)

Dennis Felsch and Mario Heiderich discovered that OpenStack Horizon did not properly perform input sanitization when creating host aggregates. If an admin user were tricked into viewing the Host Aggregates page containing a crafted availability zone name, an attacker could conduct cross-site scripting attacks. (CVE-2014-3594)

Record
USN-2323-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
horizon
PyPI
 before 8.0.0a0
8.0.0a0
horizon
Debian:12
 before 2014.1.1-3
2014.1.1-3
horizon
Debian:13
 before 2014.1.1-3
2014.1.1-3
horizon
Debian:14
 before 2014.1.1-3
2014.1.1-3
openstack-dashboard
Red Hat:openstack:5::el7
 before 0:2014.1.1-2.el7ost
0:2014.1.1-2.el7ost
openstack-dashboard-theme
Red Hat:openstack:5::el7
 before 0:2014.1.1-2.el7ost
0:2014.1.1-2.el7ost
python-django-horizon
Red Hat:openstack:5::el7
 before 0:2014.1.1-2.el7ost
0:2014.1.1-2.el7ost
python-django-horizon-doc
Red Hat:openstack:5::el7
 before 0:2014.1.1-2.el7ost
0:2014.1.1-2.el7ost
openstack-dashboard
Red Hat:openstack:4::el6
 before 0:2013.2.3-3.el6ost
0:2013.2.3-3.el6ost
openstack-dashboard-theme
Red Hat:openstack:4::el6
 before 0:2013.2.3-3.el6ost
0:2013.2.3-3.el6ost
Show 4 moreShow less
Affected packages
PackageAffectedFixed
python-django-horizon
Red Hat:openstack:4::el6
 before 0:2013.2.3-3.el6ost
0:2013.2.3-3.el6ost
python-django-horizon-doc
Red Hat:openstack:4::el6
 before 0:2013.2.3-3.el6ost
0:2013.2.3-3.el6ost
horizon
Ubuntu:14.04:LTS
 before 1:2014.1.2-0ubuntu1, plus listed versions
1:2013.2~rc3-0ubuntu11:2013.2-0ubuntu11:2014.1~b1-0ubuntu11:2014.1~b2-0ubuntu11:2014.1~b2-0ubuntu2
Show 6 moreShow less
1:2014.1~b3-0ubuntu11:2014.1~b3-0ubuntu21:2014.1~rc1-0ubuntu11:2014.1~rc2-0ubuntu11:2014.1-0ubuntu11:2014.1.1-0ubuntu1
1:2014.1.2-0ubuntu1
horizon
Ubuntu:14.04:LTS
 before 1:2014.1.2-0ubuntu1.1, plus listed versions
1:2013.2~rc3-0ubuntu11:2013.2-0ubuntu11:2014.1~b1-0ubuntu11:2014.1~b2-0ubuntu11:2014.1~b2-0ubuntu2
Show 7 moreShow less
1:2014.1~b3-0ubuntu11:2014.1~b3-0ubuntu21:2014.1~rc1-0ubuntu11:2014.1~rc2-0ubuntu11:2014.1-0ubuntu11:2014.1.1-0ubuntu11:2014.1.2-0ubuntu1
1:2014.1.2-0ubuntu1.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-3474 is a low vulnerability (CVSS 3.5) in Openstack Horizon, published July 9, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.93%, the 80th percentile. Fixed in horizon 8.0.0a0.

References

Show 37 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open