Every CVE Search/ Get API key

CVE-2014-3594

OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability in the Host Aggregates interface

3.5 LowFix available

Cross-site scripting (XSS) vulnerability in the Host Aggregates interface in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-3 allows remote administrators to inject arbitrary web script or HTML via a new host aggregate name.

Exploit likelihood

2.07%Up 0.8 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 3.5

Cross-site scripting (XSS) vulnerability in the Host Aggregates interface in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-3 allows remote administrators to inject arbitrary web script or HTML via a new host aggregate name.

Record
CVE-2014-3594
CVSS 2.0
3.5 LowAV:N/AC:M/Au:S/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE List No score

Cross-site scripting (XSS) vulnerability in the Host Aggregates interface in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-3 allows remote administrators to inject arbitrary web script or HTML via a new host aggregate name.

Record
CVE-2014-3594
Updated
2026-11-02
EUVDEUVD-2022-3174 No score

Cross-site scripting (XSS) vulnerability in the Host Aggregates interface in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-3 allows remote administrators to inject arbitrary web script or HTML via a new host aggregate name.

Record
EUVD-2022-3174
Updated
2026-11-03
GitHub AdvisoriesGHSA-8g68-2hcj-h8vg No score

OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability in the Host Aggregates interface

Cross-site scripting (XSS) vulnerability in the Host Aggregates interface in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-3 allows remote administrators to inject arbitrary web script or HTML via a new host aggregate name.

Record
GHSA-8g68-2hcj-h8vg
Weakness
CWE-79
Updated
2026-11-02
OSV No score

Cross-site scripting (XSS) vulnerability in the Host Aggregates interface in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-3 allows remote administrators to inject arbitrary web script or HTML via a new host aggregate name.

Record
CVE-2014-3594
Updated
2026-11-02
OSVDEBIAN-CVE-2014-3594 No score

Cross-site scripting (XSS) vulnerability in the Host Aggregates interface in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-3 allows remote administrators to inject arbitrary web script or HTML via a new host aggregate name.

Record
DEBIAN-CVE-2014-3594
Updated
2026-11-02
Show 4 moreShow less
OSVGHSA-8g68-2hcj-h8vg No score

OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability in the Host Aggregates interface

Cross-site scripting (XSS) vulnerability in the Host Aggregates interface in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-3 allows remote administrators to inject arbitrary web script or HTML via a new host aggregate name.

Record
GHSA-8g68-2hcj-h8vg
Weakness
CWE-79
Updated
2026-11-02
OSVPYSEC-2026-641 No score

OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability in the Host Aggregates interface

Cross-site scripting (XSS) vulnerability in the Host Aggregates interface in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-3 allows remote administrators to inject arbitrary web script or HTML via a new host aggregate name.

Record
PYSEC-2026-641
Updated
2026-11-02
OSVUBUNTU-CVE-2014-3594 No score

Cross-site scripting (XSS) vulnerability in the Host Aggregates interface in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-3 allows remote administrators to inject arbitrary web script or HTML via a new host aggregate name.

Record
UBUNTU-CVE-2014-3594
Updated
2026-11-02
OSVUSN-2323-1 No score

horizon vulnerabilities

Jason Hullinger discovered that OpenStack Horizon did not properly perform input sanitization on Heat templates. If a user were tricked into using a specially crafted Heat template, an attacker could conduct cross-site scripting attacks. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data, within the same domain. (CVE-2014-3473)

Craig Lorentzen discovered that OpenStack Horizon did not properly perform input sanitization when creating networks. If a user were tricked into launching an image using the crafted network name, an attacker could conduct cross-site scripting attacks. (CVE-2014-3474)

Michael Xin discovered that OpenStack Horizon did not properly perform input sanitization when adding users. If an admin user were tricked into viewing the users page containing a crafted email address, an attacker could conduct cross-site scripting attacks. (CVE-2014-3475)

Dennis Felsch and Mario Heiderich discovered that OpenStack Horizon did not properly perform input sanitization when creating host aggregates. If an admin user were tricked into viewing the Host Aggregates page containing a crafted availability zone name, an attacker could conduct cross-site scripting attacks. (CVE-2014-3594)

Record
USN-2323-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
horizon
PyPI
 before 8.0.0a0
8.0.0a0
horizon
Debian:12
 before 2014.1.2-3
2014.1.2-3
horizon
Debian:13
 before 2014.1.2-3
2014.1.2-3
horizon
Debian:14
 before 2014.1.2-3
2014.1.2-3
openstack-dashboard
Red Hat:openstack:4::el6
From an advisory covering 5 CVEs
 before 0:2013.2.3-3.el6ost
0:2013.2.3-3.el6ost
openstack-dashboard-theme
Red Hat:openstack:4::el6
From an advisory covering 5 CVEs
 before 0:2013.2.3-3.el6ost
0:2013.2.3-3.el6ost
python-django-horizon
Red Hat:openstack:4::el6
From an advisory covering 5 CVEs
 before 0:2013.2.3-3.el6ost
0:2013.2.3-3.el6ost
python-django-horizon-doc
Red Hat:openstack:4::el6
From an advisory covering 5 CVEs
 before 0:2013.2.3-3.el6ost
0:2013.2.3-3.el6ost
openstack-dashboard
Red Hat:openstack:5::el7
 before 0:2014.1.2-2.el7ost
0:2014.1.2-2.el7ost
openstack-dashboard-theme
Red Hat:openstack:5::el7
 before 0:2014.1.2-2.el7ost
0:2014.1.2-2.el7ost
Show 8 moreShow less
Affected packages
PackageAffectedFixed
python-django-horizon
Red Hat:openstack:5::el7
 before 0:2014.1.2-2.el7ost
0:2014.1.2-2.el7ost
python-django-horizon-doc
Red Hat:openstack:5::el7
 before 0:2014.1.2-2.el7ost
0:2014.1.2-2.el7ost
openstack-dashboard
Red Hat:openstack:5::el6
 before 0:2014.1.2-2.el6ost
0:2014.1.2-2.el6ost
openstack-dashboard-theme
Red Hat:openstack:5::el6
 before 0:2014.1.2-2.el6ost
0:2014.1.2-2.el6ost
python-django-horizon
Red Hat:openstack:5::el6
 before 0:2014.1.2-2.el6ost
0:2014.1.2-2.el6ost
python-django-horizon-doc
Red Hat:openstack:5::el6
 before 0:2014.1.2-2.el6ost
0:2014.1.2-2.el6ost
horizon
Ubuntu:14.04:LTS
 before 1:2014.1.2-0ubuntu1.1, plus listed versions
1:2013.2~rc3-0ubuntu11:2013.2-0ubuntu11:2014.1~b1-0ubuntu11:2014.1~b2-0ubuntu11:2014.1~b2-0ubuntu2
Show 7 moreShow less
1:2014.1~b3-0ubuntu11:2014.1~b3-0ubuntu21:2014.1~rc1-0ubuntu11:2014.1~rc2-0ubuntu11:2014.1-0ubuntu11:2014.1.1-0ubuntu11:2014.1.2-0ubuntu1
1:2014.1.2-0ubuntu1.1
horizon
Ubuntu:14.04:LTS
From an advisory covering 4 CVEs
 before 1:2014.1.2-0ubuntu1.1, plus listed versions
1:2013.2~rc3-0ubuntu11:2013.2-0ubuntu11:2014.1~b1-0ubuntu11:2014.1~b2-0ubuntu11:2014.1~b2-0ubuntu2
Show 7 moreShow less
1:2014.1~b3-0ubuntu11:2014.1~b3-0ubuntu21:2014.1~rc1-0ubuntu11:2014.1~rc2-0ubuntu11:2014.1-0ubuntu11:2014.1.1-0ubuntu11:2014.1.2-0ubuntu1
1:2014.1.2-0ubuntu1.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-3594 is a low vulnerability (CVSS 3.5) in Openstack Horizon, published August 19, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.07%, the 81st percentile. Fixed in horizon 8.0.0a0.

References

Show 38 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open