Every CVE Search/ Get API key

CVE-2014-8578

Cross-site scripting (XSS) vulnerability in the Groups panel in OpenStack Dashboard (Horizon)...

3.5 LowFix available

Cross-site scripting (XSS) vulnerability in the Groups panel in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-3475.

Exploit likelihood

1.18%Up 0.3 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 3.5

Cross-site scripting (XSS) vulnerability in the Groups panel in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-3475.

Record
CVE-2014-8578
CVSS 2.0
3.5 LowAV:N/AC:M/Au:S/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE List No score

Cross-site scripting (XSS) vulnerability in the Groups panel in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-3475.

Record
CVE-2014-8578
Updated
2026-11-02
EUVDEUVD-2014-8415 No score

Cross-site scripting (XSS) vulnerability in the Groups panel in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-3475.

Record
EUVD-2014-8415
Updated
2026-11-03
GitHub AdvisoriesGHSA-grxx-9m9p-rf4j No score

Cross-site scripting (XSS) vulnerability in the Groups panel in OpenStack Dashboard (Horizon)...

Cross-site scripting (XSS) vulnerability in the Groups panel in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-3475.

Record
GHSA-grxx-9m9p-rf4j
Weakness
CWE-79
Updated
2026-11-02
OSV No score

Cross-site scripting (XSS) vulnerability in the Groups panel in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-3475.

Record
CVE-2014-8578
Updated
2026-11-02
OSVDEBIAN-CVE-2014-8578 No score

Cross-site scripting (XSS) vulnerability in the Groups panel in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-3475.

Record
DEBIAN-CVE-2014-8578
Updated
2026-11-02
OSVUBUNTU-CVE-2014-8578 No score

Cross-site scripting (XSS) vulnerability in the Groups panel in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-3475.

Record
UBUNTU-CVE-2014-8578
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
horizon
Debian:12
 before 2014.1.1-3
2014.1.1-3
horizon
Debian:13
 before 2014.1.1-3
2014.1.1-3
horizon
Debian:14
 before 2014.1.1-3
2014.1.1-3
openstack-dashboard
Red Hat:openstack:5::el7
From an advisory covering 4 CVEs
 before 0:2014.1.1-2.el7ost
0:2014.1.1-2.el7ost
openstack-dashboard-theme
Red Hat:openstack:5::el7
From an advisory covering 4 CVEs
 before 0:2014.1.1-2.el7ost
0:2014.1.1-2.el7ost
python-django-horizon
Red Hat:openstack:5::el7
From an advisory covering 4 CVEs
 before 0:2014.1.1-2.el7ost
0:2014.1.1-2.el7ost
python-django-horizon-doc
Red Hat:openstack:5::el7
From an advisory covering 4 CVEs
 before 0:2014.1.1-2.el7ost
0:2014.1.1-2.el7ost
openstack-dashboard
Red Hat:openstack:4::el6
From an advisory covering 5 CVEs
 before 0:2013.2.3-3.el6ost
0:2013.2.3-3.el6ost
openstack-dashboard-theme
Red Hat:openstack:4::el6
From an advisory covering 5 CVEs
 before 0:2013.2.3-3.el6ost
0:2013.2.3-3.el6ost
python-django-horizon
Red Hat:openstack:4::el6
From an advisory covering 5 CVEs
 before 0:2013.2.3-3.el6ost
0:2013.2.3-3.el6ost
python-django-horizon-doc
Red Hat:openstack:4::el6
From an advisory covering 5 CVEs
 before 0:2013.2.3-3.el6ost
0:2013.2.3-3.el6ost
horizon
Ubuntu:14.04:LTS
 before 1:2014.1.2-0ubuntu1.1, plus listed versions
1:2013.2~rc3-0ubuntu11:2013.2-0ubuntu11:2014.1~b1-0ubuntu11:2014.1~b2-0ubuntu11:2014.1~b2-0ubuntu2
Show 7 moreShow less
1:2014.1~b3-0ubuntu11:2014.1~b3-0ubuntu21:2014.1~rc1-0ubuntu11:2014.1~rc2-0ubuntu11:2014.1-0ubuntu11:2014.1.1-0ubuntu11:2014.1.2-0ubuntu1
1:2014.1.2-0ubuntu1.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-8578 is a low vulnerability (CVSS 3.5) in Openstack Horizon, published October 31, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.18%, the 67th percentile. Fixed in horizon 2014.1.1-3.

References

Show 25 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open