Every CVE Search/ Get API key

CVE-2015-3219

OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability

4.3 MediumFix available

Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the description parameter in a heat template, which is not properly handled in the help_text attribute in the Field class.

Exploit likelihood

3.20%Up 1.9 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.3

Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the description parameter in a heat template, which is not properly handled in the help_text attribute in the Field class.

Record
CVE-2015-3219
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE List No score

Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the description parameter in a heat template, which is not properly handled in the help_text attribute in the Field class.

Record
CVE-2015-3219
Updated
2026-11-02
EUVDEUVD-2015-0022 No score

Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the description parameter in a heat template, which is not properly handled in the help_text attribute in the Field class.

Record
EUVD-2015-0022
Updated
2026-11-03
GitHub AdvisoriesGHSA-rhjj-f6gq-6gx2 5.3

OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability

Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the description parameter in a heat template, which is not properly handled in the help_text attribute in the Field class.

Record
GHSA-rhjj-f6gq-6gx2
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVGHSA-rhjj-f6gq-6gx2 5.3

OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability

Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the description parameter in a heat template, which is not properly handled in the help_text attribute in the Field class.

Record
GHSA-rhjj-f6gq-6gx2
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV No score

Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the description parameter in a heat template, which is not properly handled in the help_text attribute in the Field class.

Record
CVE-2015-3219
Updated
2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2015-3219 No score

Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the description parameter in a heat template, which is not properly handled in the help_text attribute in the Field class.

Record
DEBIAN-CVE-2015-3219
Updated
2026-11-02
OSVPYSEC-2015-40 No score

Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the description parameter in a heat template, which is not properly handled in the help_text attribute in the Field class.

Record
PYSEC-2015-40
Updated
2026-11-02
OSVSUSE-SU-2015:2064-1 No score

Security update for openstack-dashboard

This update provides fixes and enhancements for openstack-dashboard, crowbar-barclamp-nova_dashboard and python-django_openstack_auth.

openstack-dashboard:

  • Reset flavors for other than 'Boot from Image' source type. (bsc#945515)
  • Add deactivated status for glance image.
  • Fix TemplateSyntaxError at hypervisors view.
  • Fix addition of plugin panel to panel group.
  • Remove admin role name 'admin' hardcode. (bsc#935442)
  • Escape the description param from heat template. (bsc#933722, CVE-2015-3219)
  • Enhance policy rules to workflow actions and identity project.
  • Sanitation of metadata passed from Django to avoid persistent XSS. (bsc#931437, CVE-2015-3988)
  • Fix Terminate Instance on network topology page.
  • Show ports from shared nets in floating IP assoc.
  • Fix incorrect ca arguments for calling ceilometer client.
  • Fix dynamic select layout when help block is displayed.
  • Pass correct project ID to get tenant_usages. (bsc#928891)

crowbar-barclamp-nova_dashboard:

  • Allow switching on multidomain support. (bsc#945052)
  • Fix quoting of supported_provider_types. (bsc#936368)
  • Enable the POLICY_FILES setting configuration.
  • Fix attribute being fetched from wrong node. (bsc#936059)

python-django_openstack_auth:

  • Remove admin role name 'admin' hardcode in User.is_superuser().
Record
SUSE-SU-2015:2064-1
Updated
2026-11-02
OSVUBUNTU-CVE-2015-3219 No score

Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the description parameter in a heat template, which is not properly handled in the help_text attribute in the Field class.

Record
UBUNTU-CVE-2015-3219
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
horizon
PyPI
 before 8.0.0a0
8.0.0a0
horizon
Debian:12
 before 2015.1.0+2015.06.09.git15.e63af6c598-1
2015.1.0+2015.06.09.git15.e63af6c598-1
horizon
Debian:13
 before 2015.1.0+2015.06.09.git15.e63af6c598-1
2015.1.0+2015.06.09.git15.e63af6c598-1
horizon
Debian:14
 before 2015.1.0+2015.06.09.git15.e63af6c598-1
2015.1.0+2015.06.09.git15.e63af6c598-1
horizon
Debian:8
 before 2014.1.3-7+deb8u2, plus listed versions
2014.1.3-7
2014.1.3-7+deb8u2
openstack-dashboard
Red Hat:openstack:6::el7
 before 0:2014.2.3-7.el7ost
0:2014.2.3-7.el7ost
openstack-dashboard-theme
Red Hat:openstack:6::el7
 before 0:2014.2.3-7.el7ost
0:2014.2.3-7.el7ost
python-django-horizon
Red Hat:openstack:6::el7
 before 0:2014.2.3-7.el7ost
0:2014.2.3-7.el7ost
python-django-horizon-doc
Red Hat:openstack:6::el7
 before 0:2014.2.3-7.el7ost
0:2014.2.3-7.el7ost
crowbar-barclamp-nova_dashboard
SUSE:OpenStack Cloud 5
 before 1.9+git.1443622531.b2b2939-9.3
1.9+git.1443622531.b2b2939-9.3
openstack-dashboard
SUSE:OpenStack Cloud 5
 before 2014.2.4~a0~dev12-13.2
2014.2.4~a0~dev12-13.2
python-django_openstack_auth
SUSE:OpenStack Cloud 5
 before 1.1.7-11.3
1.1.7-11.3

History

History
RecordedChangedSources
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-3219 is a medium vulnerability (CVSS 4.3) in Openstack Horizon, published August 20, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.20%, the 88th percentile. Fixed in horizon 8.0.0a0.

References

Show 35 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open