Every CVE Search/ Get API key

CVE-2016-4428

OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability

5.4 MediumFix available

CVE-2016-4428 is a medium vulnerability (CVSS 5.4) in Openstack Horizon, published June 18, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.08%, the 81st percentile. Fixed in horizon 8.0.2.

Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

2.08%Up 0.5 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.4

Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.

Record
CVE-2016-4428
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0
3.5 LowAV:N/AC:M/Au:S/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE List No score

Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.

Record
CVE-2016-4428
Updated
2026-11-02
EUVDEUVD-2022-4001 No score

Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.

Record
EUVD-2022-4001
Updated
2026-11-03
GitHub AdvisoriesGHSA-grm6-x6mr-q3cv 5.4

OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability

Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.

Record
GHSA-grm6-x6mr-q3cv
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 5.4

Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.

Record
CVE-2016-4428
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2016-4428 5.4

Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.

Record
DEBIAN-CVE-2016-4428
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
Show 5 moreShow less
OSVGHSA-grm6-x6mr-q3cv 5.4

OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability

Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.

Record
GHSA-grm6-x6mr-q3cv
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVPYSEC-2026-643 5.4

OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability

Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.

Record
PYSEC-2026-643
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2016-4428 5.4

Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.

Record
UBUNTU-CVE-2016-4428
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS 3.0
5.4 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVSUSE-SU-2016:2143-1 No score

Security update for several openstack-components

This update provides the latest code from OpenStack Liberty for openstack-ceilometer, -cinder, -dashboard, -glance, -heat, -keystone, -manila, -neutron, -neutron-fwaas, -neutron-lbaas,-nova, -resource-agents, python-networking-cisco and python-openstackclient.

Additionally some security-issues have been fixed:

openstack-nova:

  • Always copy or recreate disk.info during a migration. (bsc#970258, CVE-2016-2140)

openstack-dashboard:

  • Escape anularjs templating in unsafe HTML. (bsc#983807, CVE-2016-4428)

openstack-neutron:

  • Fix bypassing of anti-spoof protection. (bsc#984443, CVE-2016-5363, bsc#984442, CVE-2016-5362)

For a detailed description of all fixes and improvements, please refer to the changelog.

Record
SUSE-SU-2016:2143-1
Updated
2026-11-02
OSVUSN-3447-1 No score

horizon vulnerability

Beth Lancaster and Brandon Sawyers discovered that OpenStack Horizon was incorrect protected against cross-site scripting (XSS) attacks. A remote authenticated user could use this issue to inject web script or HTML in a dashboard form.

Record
USN-3447-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
horizon
PyPI
 through 8.0.1
8.0.2
horizon
PyPI
 9.0.0 to 9.0.1
9.1.0
horizon
Debian:12
 before 3:9.0.1-2
3:9.0.1-2
horizon
Debian:13
 before 3:9.0.1-2
3:9.0.1-2
horizon
Debian:14
 before 3:9.0.1-2
3:9.0.1-2
horizon
Debian:7
 before 2012.1.1-10+deb7u1, plus listed versions
2012.1.1-10
2012.1.1-10+deb7u1
horizon
Debian:8
 before 2014.1.3-7+deb8u2, plus listed versions
2014.1.3-7
2014.1.3-7+deb8u2
horizon
PyPI
 before 8.0.2
8.0.2
horizon
PyPI
 9.0.0 up to 9.1.0
9.1.0
horizon
PyPI
 before 8.0.2, 9.0.0 up to 9.1.0
8.0.29.1.0
Show 44 moreShow less
Affected packages
PackageAffectedFixed
openstack-dashboard
Red Hat:openstack:5::el6
 before 0:2014.1.5-4.el6ost
0:2014.1.5-4.el6ost
openstack-dashboard-theme
Red Hat:openstack:5::el6
 before 0:2014.1.5-4.el6ost
0:2014.1.5-4.el6ost
python-django-horizon
Red Hat:openstack:5::el6
 before 0:2014.1.5-4.el6ost
0:2014.1.5-4.el6ost
python-django-horizon-doc
Red Hat:openstack:5::el6
 before 0:2014.1.5-4.el6ost
0:2014.1.5-4.el6ost
openstack-dashboard
Red Hat:openstack:5::el7
 before 0:2014.1.5-4.el7ost
0:2014.1.5-4.el7ost
openstack-dashboard-theme
Red Hat:openstack:5::el7
 before 0:2014.1.5-4.el7ost
0:2014.1.5-4.el7ost
python-django-horizon
Red Hat:openstack:5::el7
 before 0:2014.1.5-4.el7ost
0:2014.1.5-4.el7ost
python-django-horizon-doc
Red Hat:openstack:5::el7
 before 0:2014.1.5-4.el7ost
0:2014.1.5-4.el7ost
openstack-dashboard
Red Hat:openstack:8::el7
 before 1:8.0.1-4.el7ost
1:8.0.1-4.el7ost
openstack-dashboard-theme
Red Hat:openstack:8::el7
 before 1:8.0.1-4.el7ost
1:8.0.1-4.el7ost
python-django-horizon
Red Hat:openstack:8::el7
 before 1:8.0.1-4.el7ost
1:8.0.1-4.el7ost
openstack-dashboard
Red Hat:openstack:6::el7
 before 0:2014.2.3-9.el7ost
0:2014.2.3-9.el7ost
openstack-dashboard-theme
Red Hat:openstack:6::el7
 before 0:2014.2.3-9.el7ost
0:2014.2.3-9.el7ost
python-django-horizon
Red Hat:openstack:6::el7
 before 0:2014.2.3-9.el7ost
0:2014.2.3-9.el7ost
python-django-horizon-doc
Red Hat:openstack:6::el7
 before 0:2014.2.3-9.el7ost
0:2014.2.3-9.el7ost
openstack-dashboard
Red Hat:openstack:7::el7
 before 0:2015.1.4-1.el7ost
0:2015.1.4-1.el7ost
openstack-dashboard-theme
Red Hat:openstack:7::el7
 before 0:2015.1.4-1.el7ost
0:2015.1.4-1.el7ost
python-django-horizon
Red Hat:openstack:7::el7
 before 0:2015.1.4-1.el7ost
0:2015.1.4-1.el7ost
python-django-horizon-doc
Red Hat:openstack:7::el7
 before 0:2015.1.4-1.el7ost
0:2015.1.4-1.el7ost
openstack-ceilometer
SUSE:OpenStack Cloud 6
 before 5.0.4~a0~dev6-6.1
5.0.4~a0~dev6-6.1
openstack-ceilometer-doc
SUSE:OpenStack Cloud 6
 before 5.0.4~a0~dev6-6.2
5.0.4~a0~dev6-6.2
openstack-cinder
SUSE:OpenStack Cloud 6
 before 7.0.3~a0~dev2-7.1
7.0.3~a0~dev2-7.1
openstack-cinder-doc
SUSE:OpenStack Cloud 6
 before 7.0.3~a0~dev2-7.1
7.0.3~a0~dev2-7.1
openstack-dashboard
SUSE:OpenStack Cloud 6
 before 8.0.2~a0~dev34-8.1
8.0.2~a0~dev34-8.1
openstack-glance
SUSE:OpenStack Cloud 6
 before 11.0.2~a0~dev13-7.1
11.0.2~a0~dev13-7.1
openstack-glance-doc
SUSE:OpenStack Cloud 6
 before 11.0.2~a0~dev13-7.1
11.0.2~a0~dev13-7.1
openstack-heat
SUSE:OpenStack Cloud 6
 before 5.0.2~a0~dev93-9.1
5.0.2~a0~dev93-9.1
openstack-heat-doc
SUSE:OpenStack Cloud 6
 before 5.0.2~a0~dev93-9.3
5.0.2~a0~dev93-9.3
openstack-keystone
SUSE:OpenStack Cloud 6
 before 8.1.1~a0~dev13-3.1
8.1.1~a0~dev13-3.1
openstack-keystone-doc
SUSE:OpenStack Cloud 6
 before 8.1.1~a0~dev13-3.2
8.1.1~a0~dev13-3.2
openstack-manila
SUSE:OpenStack Cloud 6
 before 1.0.2~a0~dev11-9.1
1.0.2~a0~dev11-9.1
openstack-manila-doc
SUSE:OpenStack Cloud 6
 before 1.0.2~a0~dev11-9.2
1.0.2~a0~dev11-9.2
openstack-neutron
SUSE:OpenStack Cloud 6
 before 7.1.2~a0~dev29-10.1
7.1.2~a0~dev29-10.1
openstack-neutron-doc
SUSE:OpenStack Cloud 6
 before 7.1.2~a0~dev29-10.1
7.1.2~a0~dev29-10.1
openstack-neutron-fwaas
SUSE:OpenStack Cloud 6
 before 7.1.2~a0~dev1-6.1
7.1.2~a0~dev1-6.1
openstack-neutron-fwaas-doc
SUSE:OpenStack Cloud 6
 before 7.1.2~a0~dev1-6.1
7.1.2~a0~dev1-6.1
openstack-neutron-lbaas
SUSE:OpenStack Cloud 6
 before 7.1.2~a0~dev1-6.1
7.1.2~a0~dev1-6.1
openstack-neutron-lbaas-doc
SUSE:OpenStack Cloud 6
 before 7.1.2~a0~dev1-6.1
7.1.2~a0~dev1-6.1
openstack-nova
SUSE:OpenStack Cloud 6
 before 12.0.5~a0~dev2-7.1
12.0.5~a0~dev2-7.1
openstack-nova-doc
SUSE:OpenStack Cloud 6
 before 12.0.5~a0~dev2-7.1
12.0.5~a0~dev2-7.1
openstack-resource-agents
SUSE:OpenStack Cloud 6
 before 1.0+git.1467079370.4f2c49d-7.1
1.0+git.1467079370.4f2c49d-7.1
python-networking-cisco
SUSE:OpenStack Cloud 6
 before 2.1.1-6.1
2.1.1-6.1
python-openstackclient
SUSE:OpenStack Cloud 6
 before 1.7.2-4.1
1.7.2-4.1
horizon
Ubuntu:14.04:LTS
 before 1:2014.1.5-0ubuntu2.1, plus listed versions
1:2013.2~rc3-0ubuntu11:2013.2-0ubuntu11:2014.1~b1-0ubuntu11:2014.1~b2-0ubuntu11:2014.1~b2-0ubuntu2
Show 13 moreShow less
1:2014.1~b3-0ubuntu11:2014.1~b3-0ubuntu21:2014.1~rc1-0ubuntu11:2014.1~rc2-0ubuntu11:2014.1-0ubuntu11:2014.1.1-0ubuntu11:2014.1.2-0ubuntu11:2014.1.2-0ubuntu1.11:2014.1.3-0ubuntu11:2014.1.3-0ubuntu21:2014.1.4-0ubuntu21:2014.1.5-0ubuntu11:2014.1.5-0ubuntu2
1:2014.1.5-0ubuntu2.1

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 39 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open