CVE-2015-3219
OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability
CVE-2015-3219 is a medium vulnerability (CVSS 4.3) in Openstack Horizon, published August 20, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.20%, the 88th percentile. Fixed in horizon 8.0.0a0.
- Severity
- 4.3 MediumCVSS 2.0, NVD
- Exploit chance
- 3.20%EPSS, 88th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
8.0.0a0horizon +11 more
Description
Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the description parameter in a heat template, which is not properly handled in the help_text attribute in the Field class.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
horizonPyPI | before 8.0.0a0 | 8.0.0a0 |
horizonDebian:12 | before 2015.1.0+2015.06.09.git15.e63af6c598-1 | 2015.1.0+2015.06.09.git15.e63af6c598-1 |
horizonDebian:13 | before 2015.1.0+2015.06.09.git15.e63af6c598-1 | 2015.1.0+2015.06.09.git15.e63af6c598-1 |
horizonDebian:14 | before 2015.1.0+2015.06.09.git15.e63af6c598-1 | 2015.1.0+2015.06.09.git15.e63af6c598-1 |
horizonDebian:8 From an advisory covering 2 CVEs | before 2014.1.3-7+deb8u2, plus listed versions 2014.1.3-7 | 2014.1.3-7+deb8u2 |
openstack-dashboardRed Hat:openstack:6::el7 From an advisory covering 2 CVEs | before 0:2014.2.3-7.el7ost | 0:2014.2.3-7.el7ost |
openstack-dashboard-themeRed Hat:openstack:6::el7 From an advisory covering 2 CVEs | before 0:2014.2.3-7.el7ost | 0:2014.2.3-7.el7ost |
python-django-horizonRed Hat:openstack:6::el7 From an advisory covering 2 CVEs | before 0:2014.2.3-7.el7ost | 0:2014.2.3-7.el7ost |
python-django-horizon-docRed Hat:openstack:6::el7 From an advisory covering 2 CVEs | before 0:2014.2.3-7.el7ost | 0:2014.2.3-7.el7ost |
crowbar-barclamp-nova_dashboardSUSE:OpenStack Cloud 5 From an advisory covering 2 CVEs | before 1.9+git.1443622531.b2b2939-9.3 | 1.9+git.1443622531.b2b2939-9.3 |
openstack-dashboardSUSE:OpenStack Cloud 5 From an advisory covering 2 CVEs | before 2014.2.4~a0~dev12-13.2 | 2014.2.4~a0~dev12-13.2 |
python-django_openstack_authSUSE:OpenStack Cloud 5 From an advisory covering 2 CVEs | before 1.1.7-11.3 | 1.1.7-11.3 |
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the description parameter in a heat template, which is not properly handled in the help_text attribute in the Field class.
- Record
CVE-2015-3219- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE ListNo score
Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the description parameter in a heat template, which is not properly handled in the help_text attribute in the Field class.
- Record
CVE-2015-3219- Updated
- 2026-11-02
EUVDEUVD-2015-0022No score
Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the description parameter in a heat template, which is not properly handled in the help_text attribute in the Field class.
- Record
EUVD-2015-0022- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rhjj-f6gq-6gx2
OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the description parameter in a heat template, which is not properly handled in the help_text attribute in the Field class.
- Record
GHSA-rhjj-f6gq-6gx2- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-rhjj-f6gq-6gx2
OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the description parameter in a heat template, which is not properly handled in the help_text attribute in the Field class.
- Record
GHSA-rhjj-f6gq-6gx2- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVNo score
Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the description parameter in a heat template, which is not properly handled in the help_text attribute in the Field class.
- Record
CVE-2015-3219- Updated
- 2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2015-3219No score
Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the description parameter in a heat template, which is not properly handled in the help_text attribute in the Field class.
- Record
DEBIAN-CVE-2015-3219- Updated
- 2026-11-02
OSVPYSEC-2015-40No score
Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the description parameter in a heat template, which is not properly handled in the help_text attribute in the Field class.
- Record
PYSEC-2015-40- Updated
- 2026-11-02
OSVSUSE-SU-2015:2064-1No score
Security update for openstack-dashboard
This update provides fixes and enhancements for openstack-dashboard, crowbar-barclamp-nova_dashboard and python-django_openstack_auth.
openstack-dashboard:
- Reset flavors for other than 'Boot from Image' source type. (bsc#945515)
- Add deactivated status for glance image.
- Fix TemplateSyntaxError at hypervisors view.
- Fix addition of plugin panel to panel group.
- Remove admin role name 'admin' hardcode. (bsc#935442)
- Escape the description param from heat template. (bsc#933722, CVE-2015-3219)
- Enhance policy rules to workflow actions and identity project.
- Sanitation of metadata passed from Django to avoid persistent XSS. (bsc#931437, CVE-2015-3988)
- Fix Terminate Instance on network topology page.
- Show ports from shared nets in floating IP assoc.
- Fix incorrect ca arguments for calling ceilometer client.
- Fix dynamic select layout when help block is displayed.
- Pass correct project ID to get tenant_usages. (bsc#928891)
crowbar-barclamp-nova_dashboard:
- Allow switching on multidomain support. (bsc#945052)
- Fix quoting of supported_provider_types. (bsc#936368)
- Enable the POLICY_FILES setting configuration.
- Fix attribute being fetched from wrong node. (bsc#936059)
python-django_openstack_auth:
- Remove admin role name 'admin' hardcode in User.is_superuser().
- Record
SUSE-SU-2015:2064-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-3219No score
Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the description parameter in a heat template, which is not properly handled in the help_text attribute in the Field class.
- Record
UBUNTU-CVE-2015-3219- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
lists.openstack.org/pipermail/openstack-announce/2015-June/000361.html
bugs.launchpad.net/horizon/+bug/1453074
securityfocus.com/bid/75109
debian.org/security/2016/dsa-3617
oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
rhn.redhat.com/errata/RHSA-2015-1679.html
Show 35 moreShow less
openwall.com/lists/oss-security/2015/06/09/7
nvd.nist.gov/vuln/detail/CVE-2015-3219
github.com/openstack/horizon/commit/28d8f49786d6df297b2574514916fa782e941e09
security-tracker.debian.org/tracker/CVE-2015-3219
access.redhat.com/errata/RHSA-2015:1679
bugzilla.redhat.com/show_bug.cgi?id=1187992
security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1679.json
cve.org/CVERecord?id=CVE-2015-3219
suse.com/support/update/announcement/2015/suse-su-20152064-1
bugzilla.suse.com/928891
ubuntu.com/security/CVE-2015-3219