Every CVE Search/ Get API key

CVE-2014-3475

Cross-site scripting (XSS) vulnerability in the Users panel (admin/users/) in OpenStack Dashboard...

3.5 LowFix available

Cross-site scripting (XSS) vulnerability in the Users panel (admin/users/) in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-8578.

Exploit likelihood

1.23%Up 0.3 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 3.5

Cross-site scripting (XSS) vulnerability in the Users panel (admin/users/) in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-8578.

Record
CVE-2014-3475
CVSS 2.0
3.5 LowAV:N/AC:M/Au:S/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE List No score

Cross-site scripting (XSS) vulnerability in the Users panel (admin/users/) in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-8578.

Record
CVE-2014-3475
Updated
2026-11-02
EUVDEUVD-2014-3485 No score

Cross-site scripting (XSS) vulnerability in the Users panel (admin/users/) in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-8578.

Record
EUVD-2014-3485
Updated
2026-11-03
GitHub AdvisoriesGHSA-vw9p-vx37-72h4 No score

Cross-site scripting (XSS) vulnerability in the Users panel (admin/users/) in OpenStack Dashboard...

Cross-site scripting (XSS) vulnerability in the Users panel (admin/users/) in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-8578.

Record
GHSA-vw9p-vx37-72h4
Weakness
CWE-79
Updated
2026-11-02
OSV No score

Cross-site scripting (XSS) vulnerability in the Users panel (admin/users/) in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-8578.

Record
CVE-2014-3475
Updated
2026-11-02
OSVDEBIAN-CVE-2014-3475 No score

Cross-site scripting (XSS) vulnerability in the Users panel (admin/users/) in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-8578.

Record
DEBIAN-CVE-2014-3475
Updated
2026-11-02
OSVSUSE-RU-2015:0410-1 No score

Security update for openstack-dashboard

This update for openstack-dashboard fixes a cross-site scripting issue on the unordered_list filter. (bnc#891815, CVE-2014-3594)

Security Issues:

* CVE-2014-3475
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3475>
Record
SUSE-RU-2015:0410-1
Updated
2026-11-02
OSVUBUNTU-CVE-2014-3475 No score

Cross-site scripting (XSS) vulnerability in the Users panel (admin/users/) in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-8578.

Record
UBUNTU-CVE-2014-3475
Updated
2026-11-02
OSVUSN-2323-1 No score

horizon vulnerabilities

Jason Hullinger discovered that OpenStack Horizon did not properly perform input sanitization on Heat templates. If a user were tricked into using a specially crafted Heat template, an attacker could conduct cross-site scripting attacks. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. (CVE-2014-3473)

Craig Lorentzen discovered that OpenStack Horizon did not properly perform input sanitization when creating networks. If a user were tricked into launching an image using the crafted network name, an attacker could conduct cross-site scripting attacks. (CVE-2014-3474)

Michael Xin discovered that OpenStack Horizon did not properly perform input sanitization when adding users. If an admin user were tricked into viewing the users page containing a crafted email address, an attacker could conduct cross-site scripting attacks. (CVE-2014-3475)

Dennis Felsch and Mario Heiderich discovered that OpenStack Horizon did not properly perform input sanitization when creating host aggregates. If an admin user were tricked into viewing the Host Aggregates page containing a crafted availability zone name, an attacker could conduct cross-site scripting attacks. (CVE-2014-3594)

Record
USN-2323-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
horizon
Debian:12
 before 2014.1.1-3
2014.1.1-3
horizon
Debian:13
 before 2014.1.1-3
2014.1.1-3
horizon
Debian:14
 before 2014.1.1-3
2014.1.1-3
openstack-dashboard
Red Hat:openstack:5::el7
From an advisory covering 4 CVEs
 before 0:2014.1.1-2.el7ost
0:2014.1.1-2.el7ost
openstack-dashboard-theme
Red Hat:openstack:5::el7
From an advisory covering 4 CVEs
 before 0:2014.1.1-2.el7ost
0:2014.1.1-2.el7ost
python-django-horizon
Red Hat:openstack:5::el7
From an advisory covering 4 CVEs
 before 0:2014.1.1-2.el7ost
0:2014.1.1-2.el7ost
python-django-horizon-doc
Red Hat:openstack:5::el7
From an advisory covering 4 CVEs
 before 0:2014.1.1-2.el7ost
0:2014.1.1-2.el7ost
openstack-dashboard
Red Hat:openstack:4::el6
From an advisory covering 5 CVEs
 before 0:2013.2.3-3.el6ost
0:2013.2.3-3.el6ost
openstack-dashboard-theme
Red Hat:openstack:4::el6
From an advisory covering 5 CVEs
 before 0:2013.2.3-3.el6ost
0:2013.2.3-3.el6ost
python-django-horizon
Red Hat:openstack:4::el6
From an advisory covering 5 CVEs
 before 0:2013.2.3-3.el6ost
0:2013.2.3-3.el6ost
python-django-horizon-doc
Red Hat:openstack:4::el6
From an advisory covering 5 CVEs
 before 0:2013.2.3-3.el6ost
0:2013.2.3-3.el6ost
horizon
Ubuntu:14.04:LTS
 before 1:2014.1.2-0ubuntu1, plus listed versions
1:2013.2~rc3-0ubuntu11:2013.2-0ubuntu11:2014.1~b1-0ubuntu11:2014.1~b2-0ubuntu11:2014.1~b2-0ubuntu2
Show 6 moreShow less
1:2014.1~b3-0ubuntu11:2014.1~b3-0ubuntu21:2014.1~rc1-0ubuntu11:2014.1~rc2-0ubuntu11:2014.1-0ubuntu11:2014.1.1-0ubuntu1
1:2014.1.2-0ubuntu1
horizon
Ubuntu:14.04:LTS
From an advisory covering 4 CVEs
 before 1:2014.1.2-0ubuntu1.1, plus listed versions
1:2013.2~rc3-0ubuntu11:2013.2-0ubuntu11:2014.1~b1-0ubuntu11:2014.1~b2-0ubuntu11:2014.1~b2-0ubuntu2
Show 7 moreShow less
1:2014.1~b3-0ubuntu11:2014.1~b3-0ubuntu21:2014.1~rc1-0ubuntu11:2014.1~rc2-0ubuntu11:2014.1-0ubuntu11:2014.1.1-0ubuntu11:2014.1.2-0ubuntu1
1:2014.1.2-0ubuntu1.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-3475 is a low vulnerability (CVSS 3.5) in Openstack Horizon, published July 9, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.23%, the 69th percentile. Fixed in horizon 2014.1.1-3.

References

Show 39 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open