CVE-2020-29565
OpenStack Horizon Open redirect in workflow forms
An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the "next" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the "next" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL.
- Record
CVE-2020-29565- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the "next" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL.
- Record
CVE-2020-29565- Updated
- 2026-11-02
EUVDEUVD-2020-0084 No score
An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the "next" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL.
- Record
EUVD-2020-0084- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f8fh-xp28-q59m
OpenStack Horizon Open redirect in workflow forms
An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the "next" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL.
- Record
GHSA-f8fh-xp28-q59m- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSV
An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the "next" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL.
- Record
CVE-2020-29565- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-29565
An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the "next" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL.
- Record
DEBIAN-CVE-2020-29565- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Show 7 moreShow less
OSVGHSA-f8fh-xp28-q59m
OpenStack Horizon Open redirect in workflow forms
An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the "next" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL.
- Record
GHSA-f8fh-xp28-q59m- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSVRHSA-2020:5411
Red Hat Security Advisory: python-django-horizon security update
- Record
RHSA-2020:5411- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVRHSA-2020:5572
Red Hat Security Advisory: python-django-horizon security update
- Record
RHSA-2020:5572- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-29565
An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the "next" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL.
- Record
UBUNTU-CVE-2020-29565- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVPYSEC-2020-45 No score
An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the "next" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL.
- Record
PYSEC-2020-45- Updated
- 2026-11-02
OSVSUSE-SU-2021:0099-1 No score
Security update for openstack-dashboard, release-notes-suse-openstack-cloud
This update for openstack-dashboard, release-notes-suse-openstack-cloud fixes the following issues:
- Fix open redirect (OSSA-2020-008, CVE-2020-29565)
- Fix horizon-nodejs jobs.
- Add workaround for secure boot issue when shim package is updated. (bsc#1179955)
- Record
SUSE-SU-2021:0099-1- Updated
- 2026-11-02
OSVUSN-4675-1 No score
horizon vulnerability
Pritam Singh discovered that OpenStack Horizon incorrectly validated certain parameters. An attacker could possibly use this issue to cause OpenStack Horizon to redirect to a malicious URL.
- Record
USN-4675-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
horizonPyPI |
before 15.3.2 | 15.3.2 |
horizonPyPI |
16.0.0 up to 16.2.1 | 16.2.1 |
horizonPyPI |
17.0.0 up to 18.3.3 | 18.3.3 |
horizonPyPI |
18.4.0 up to 18.6.0 | 18.6.0 |
horizonDebian:12 |
before 3:18.6.1-1 | 3:18.6.1-1 |
horizonDebian:13 |
before 3:18.6.1-1 | 3:18.6.1-1 |
horizonDebian:14 |
before 3:18.6.1-1 | 3:18.6.1-1 |
horizonDebian:10 |
before 3:14.0.2-3+deb10u2, plus listed versions 3:14.0.2-3 |
3:14.0.2-3+deb10u2 |
horizonPyPI |
before 15.3.2, plus listed versions 12.0.212.0.312.0.413.0.013.0.0.0b3 Show 26 moreShow less13.0.0.0rc113.0.0.0rc213.0.113.0.213.0.314.0.014.0.0.0b114.0.0.0b214.0.0.0b314.0.0.0rc114.0.0.0rc214.0.114.0.214.0.314.0.414.1.015.0.015.0.0.0b115.0.0.0b215.0.0.0rc115.0.0.0rc215.1.015.1.115.2.015.3.015.3.1 |
15.3.2 |
horizonPyPI |
16.0.0 up to 16.2.1, plus listed versions 16.1.016.2.0 |
16.2.1 |
Show 17 moreShow less
| Package | Affected | Fixed |
|---|---|---|
horizonPyPI |
17.0.0 up to 18.3.3, plus listed versions 17.1.018.0.018.1.018.2.018.3.018.3.118.3.2 |
18.3.3 |
horizonPyPI |
18.4.0 up to 18.6.0, plus listed versions 18.4.118.5.0 |
18.6.0 |
horizonPyPI |
15.3.0 up to 15.3.2, 16.0.0 up to 16.2.1, 17.0.0 up to 18.3.3, 18.4.0 up to 18.6.0, plus listed versions 15.3.116.1.016.2.017.1.018.0.0 Show 7 moreShow less18.1.018.2.018.3.018.3.118.3.218.4.118.5.0 |
15.3.216.2.118.3.318.6.0 |
openstack-dashboardRed Hat:openstack:16.1::el8 |
before 1:16.2.1-1.20201114033610.el8ost | 1:16.2.1-1.20201114033610.el8ost |
python-django-horizonRed Hat:openstack:16.1::el8 |
before 1:16.2.1-1.20201114033610.el8ost | 1:16.2.1-1.20201114033610.el8ost |
python3-django-horizonRed Hat:openstack:16.1::el8 |
before 1:16.2.1-1.20201114033610.el8ost | 1:16.2.1-1.20201114033610.el8ost |
openstack-dashboardRed Hat:openstack:13::el7 |
before 1:13.0.3-7.el7ost | 1:13.0.3-7.el7ost |
python-django-horizonRed Hat:openstack:13::el7 |
before 1:13.0.3-7.el7ost | 1:13.0.3-7.el7ost |
openstack-dashboardSUSE:HPE Helion OpenStack 8 |
before 12.0.5~dev6-3.29.1 | 12.0.5~dev6-3.29.1 |
release-notes-hpe-helion-openstackSUSE:HPE Helion OpenStack 8 |
before 8.20201214-3.26.1 | 8.20201214-3.26.1 |
openstack-dashboardSUSE:OpenStack Cloud 8 |
before 12.0.5~dev6-3.29.1 | 12.0.5~dev6-3.29.1 |
release-notes-suse-openstack-cloudSUSE:OpenStack Cloud 8 |
before 8.20201214-3.26.1 | 8.20201214-3.26.1 |
openstack-dashboardSUSE:OpenStack Cloud Crowbar 8 |
before 12.0.5~dev6-3.29.1 | 12.0.5~dev6-3.29.1 |
release-notes-suse-openstack-cloudSUSE:OpenStack Cloud Crowbar 8 |
before 8.20201214-3.26.1 | 8.20201214-3.26.1 |
horizonUbuntu:16.04:LTS |
before 2:9.1.2-0ubuntu5.2, plus listed versions 2:8.0.0-0ubuntu22:9.0.0~b1-0ubuntu12:9.0.0~b1-0ubuntu22:9.0.0~b2-0ubuntu12:9.0.0~b3-0ubuntu1 Show 11 moreShow less2:9.0.0~rc1-0ubuntu12:9.0.0-0ubuntu12:9.0.0-0ubuntu22:9.0.0-0ubuntu2.16.04.12:9.0.1-0ubuntu22:9.1.0-0ubuntu12:9.1.1-0ubuntu12:9.1.2-0ubuntu12:9.1.2-0ubuntu22:9.1.2-0ubuntu32:9.1.2-0ubuntu5 |
2:9.1.2-0ubuntu5.2 |
horizonUbuntu:18.04:LTS |
before 3:13.0.3-0ubuntu2, plus listed versions 3:12.0.0-0ubuntu2.13:12.0.0-0ubuntu33:13.0.0~b1-0ubuntu13:13.0.0~b1-0ubuntu23:13.0.0-0ubuntu1 Show 11 moreShow less3:13.0.0-0ubuntu1.13:13.0.1-0ubuntu13:13.0.1-0ubuntu23:13.0.1-0ubuntu33:13.0.1-0ubuntu43:13.0.1-0ubuntu53:13.0.1-0ubuntu63:13.0.2-0ubuntu13:13.0.2-0ubuntu23:13.0.2-0ubuntu33:13.0.3-0ubuntu1 |
3:13.0.3-0ubuntu2 |
horizonUbuntu:20.04:LTS |
before 3:18.3.2-0ubuntu0.20.04.4, plus listed versions 3:16.0.0-0ubuntu13:17.0.0~b1~git2019121712.f7313b74c-0ubuntu13:18.0.1~git2020021409.bb959361b-0ubuntu23:18.0.1~git2020021409.bb959361b-0ubuntu33:18.2.1~git2020032709.2c4470272-0ubuntu1 Show 5 moreShow less3:18.2.1~git2020041013.754804667-0ubuntu13:18.2.1~git2020041013.754804667-0ubuntu23:18.2.1~git2020041013.754804667-0ubuntu33:18.3.2-0ubuntu0.20.04.13:18.3.2-0ubuntu0.20.04.2 |
3:18.3.2-0ubuntu0.20.04.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-29565 is a medium vulnerability (CVSS 6.1) in Openstack Horizon, published December 4, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.42%, the 73rd percentile. Fixed in horizon 15.3.2.
References
bugs.launchpad.net/horizon/+bug/1865026
review.opendev.org/c/openstack/horizon/+/758841
security.openstack.org/ossa/OSSA-2020-008.html
openwall.com/lists/oss-security/2020/12/08/2
debian.org/security/2020/dsa-4820
Show 22 moreShow less
nvd.nist.gov/vuln/detail/CVE-2020-29565
github.com/openstack/horizon/commit/252467100f75587e18df9c43ed5802ee8f0017fa
security-tracker.debian.org/tracker/CVE-2020-29565
access.redhat.com/errata/RHSA-2020:5411
bugzilla.redhat.com/show_bug.cgi?id=1811510
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5411.json
cve.org/CVERecord?id=CVE-2020-29565
suse.com/support/update/announcement/2021/suse-su-20210099-1
bugzilla.suse.com/1179955
ubuntu.com/security/CVE-2020-29565