CVE-2014-3497
OpenStack Swift Cross-site Scriping vulnerability
CVE-2014-3497 is a medium vulnerability (CVSS 4.3) in Openstack Swift, published June 20, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.10%, the 81st percentile. Fixed in swift 2.0.0.
Cross-site scripting (XSS) vulnerability in OpenStack Swift 1.11.0 through 1.13.1 allows remote attackers to inject arbitrary web script or HTML via the WWW-Authenticate header.
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in OpenStack Swift 1.11.0 through 1.13.1 allows remote attackers to inject arbitrary web script or HTML via the WWW-Authenticate header.
- Record
CVE-2014-3497- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in OpenStack Swift 1.11.0 through 1.13.1 allows remote attackers to inject arbitrary web script or HTML via the WWW-Authenticate header.
- Record
CVE-2014-3497- Updated
- 2026-11-02
EUVDEUVD-2022-2732 No score
Cross-site scripting (XSS) vulnerability in OpenStack Swift 1.11.0 through 1.13.1 allows remote attackers to inject arbitrary web script or HTML via the WWW-Authenticate header.
- Record
EUVD-2022-2732- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-66vj-393f-hxfv No score
OpenStack Swift Cross-site Scriping vulnerability
Cross-site scripting (XSS) vulnerability in OpenStack Swift 1.11.0 through 1.13.1 allows remote attackers to inject arbitrary web script or HTML via the WWW-Authenticate header.
- Record
GHSA-66vj-393f-hxfv- Weakness
- CWE-79
- Updated
- 2026-11-02
OSV No score
Cross-site scripting (XSS) vulnerability in OpenStack Swift 1.11.0 through 1.13.1 allows remote attackers to inject arbitrary web script or HTML via the WWW-Authenticate header.
- Record
CVE-2014-3497- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-3497 No score
Cross-site scripting (XSS) vulnerability in OpenStack Swift 1.11.0 through 1.13.1 allows remote attackers to inject arbitrary web script or HTML via the WWW-Authenticate header.
- Record
DEBIAN-CVE-2014-3497- Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-66vj-393f-hxfv No score
OpenStack Swift Cross-site Scriping vulnerability
Cross-site scripting (XSS) vulnerability in OpenStack Swift 1.11.0 through 1.13.1 allows remote attackers to inject arbitrary web script or HTML via the WWW-Authenticate header.
- Record
GHSA-66vj-393f-hxfv- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVPYSEC-2026-928 No score
OpenStack Swift Cross-site Scriping vulnerability
Cross-site scripting (XSS) vulnerability in OpenStack Swift 1.11.0 through 1.13.1 allows remote attackers to inject arbitrary web script or HTML via the WWW-Authenticate header.
- Record
PYSEC-2026-928- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-3497 No score
Cross-site scripting (XSS) vulnerability in OpenStack Swift 1.11.0 through 1.13.1 allows remote attackers to inject arbitrary web script or HTML via the WWW-Authenticate header.
- Record
UBUNTU-CVE-2014-3497- Updated
- 2026-11-02
OSVUSN-2256-1 No score
swift vulnerability
John Dickinson discovered that Swift did not properly quote the WWW-Authenticate header value. If a user were tricked into navigating to a malicious Swift URL, an attacker could conduct cross-site scripting attacks. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain.
- Record
USN-2256-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
swiftPyPI |
1.11.0 to 1.13.1 | 2.0.0 |
swiftDebian:12 |
before 1.13.1-1 | 1.13.1-1 |
swiftDebian:13 |
before 1.13.1-1 | 1.13.1-1 |
swiftDebian:14 |
before 1.13.1-1 | 1.13.1-1 |
swiftPyPI |
1.11.0 up to 2.0.0 | 2.0.0 |
openstack-swiftRed Hat:openstack:5::el7 |
before 0:1.13.1-3.el7ost | 0:1.13.1-3.el7ost |
openstack-swift-accountRed Hat:openstack:5::el7 |
before 0:1.13.1-3.el7ost | 0:1.13.1-3.el7ost |
openstack-swift-containerRed Hat:openstack:5::el7 |
before 0:1.13.1-3.el7ost | 0:1.13.1-3.el7ost |
openstack-swift-docRed Hat:openstack:5::el7 |
before 0:1.13.1-3.el7ost | 0:1.13.1-3.el7ost |
openstack-swift-objectRed Hat:openstack:5::el7 |
before 0:1.13.1-3.el7ost | 0:1.13.1-3.el7ost |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
openstack-swift-proxyRed Hat:openstack:5::el7 |
before 0:1.13.1-3.el7ost | 0:1.13.1-3.el7ost |
python-swiftclientRed Hat:openstack:5::el7 |
before 0:2.1.0-2.el7ost | 0:2.1.0-2.el7ost |
python-swiftclient-docRed Hat:openstack:5::el7 |
before 0:2.1.0-2.el7ost | 0:2.1.0-2.el7ost |
swiftUbuntu:14.04:LTS |
before 1.13.1-0ubuntu1.1, plus listed versions 1.10.0~rc1-0ubuntu11.10.0-0ubuntu11.11.0-0ubuntu21.12.0-0ubuntu11.13.0-0ubuntu11.13.1~rc1-0ubuntu21.13.1~rc2-0ubuntu11.13.1-0ubuntu1 |
1.13.1-0ubuntu1.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
ubuntu.com/usn/USN-2256-1
secunia.com/advisories/59532
review.openstack.org
openwall.com/lists/oss-security/2014/06/19/10
securityfocus.com/bid/68116
lists.openstack.org/pipermail/openstack-announce/2014-June/000243.html
Show 14 moreShow less
nvd.nist.gov/vuln/detail/CVE-2014-3497
access.redhat.com/errata/RHSA-2014:0941
bugzilla.redhat.com/show_bug.cgi?id=1110809
web.archive.org/web/20200229060002/http://www.securityfocus.com/bid/68116
github.com/advisories/GHSA-66vj-393f-hxfv
security-tracker.debian.org/tracker/CVE-2014-3497
opendev.org/openstack/swift
pypi.org/project/swift
security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0941.json
cve.org/CVERecord?id=CVE-2014-3497
ubuntu.com/security/CVE-2014-3497