{"id":"CVE-2014-3473","aliases":["DEBIAN-CVE-2014-3473","EUVD-2022-3247","GHSA-8vwv-2v7v-jmgr","PYSEC-2026-642","RHSA-2014:0939","RHSA-2014:1188","UBUNTU-CVE-2014-3473","USN-2323-1"],"status":"published","title":"Horizon-Orchestration Cross-site scripting (XSS) vulnerability through resource name","description":"Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when used with Heat, allows remote Orchestration template owners or catalogs to inject arbitrary web script or HTML via a crafted template.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01703,"percentile":0.77393,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2014-07-09T00:00:00Z","modified":"2026-10-23T15:47:28Z","fixes":[{"ecosystem":"PyPI","package":"horizon","fixed_in":["8.0.0a0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"horizon","fixed_in":["2014.1.1-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"horizon","fixed_in":["2014.1.1-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"horizon","fixed_in":["2014.1.1-3"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"horizon","fixed_in":["1:2014.1.2-0ubuntu1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.0a0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2014.1.1-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2014.1.1-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2014.1.1-3"}]}]},{"source":"osv","ecosystem":"PyPI","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.0a0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.0a0"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"openstack-dashboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.1-2.el7ost"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"openstack-dashboard-theme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.1-2.el7ost"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"python-django-horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.1-2.el7ost"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"python-django-horizon-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.1-2.el7ost"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:openstack:4::el6","package":"openstack-dashboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2013.2.3-3.el6ost"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openstack:4::el6","package":"openstack-dashboard-theme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2013.2.3-3.el6ost"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openstack:4::el6","package":"python-django-horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2013.2.3-3.el6ost"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openstack:4::el6","package":"python-django-horizon-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2013.2.3-3.el6ost"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2014.1.2-0ubuntu1"}]}],"versions":["1:2013.2~rc3-0ubuntu1","1:2013.2-0ubuntu1","1:2014.1~b1-0ubuntu1","1:2014.1~b2-0ubuntu1","1:2014.1~b2-0ubuntu2","1:2014.1~b3-0ubuntu1","1:2014.1~b3-0ubuntu2","1:2014.1~rc1-0ubuntu1","1:2014.1~rc2-0ubuntu1","1:2014.1-0ubuntu1","1:2014.1.1-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2014.1.2-0ubuntu1.1"}]}],"versions":["1:2013.2~rc3-0ubuntu1","1:2013.2-0ubuntu1","1:2014.1~b1-0ubuntu1","1:2014.1~b2-0ubuntu1","1:2014.1~b2-0ubuntu2","1:2014.1~b3-0ubuntu1","1:2014.1~b3-0ubuntu2","1:2014.1~rc1-0ubuntu1","1:2014.1~rc2-0ubuntu1","1:2014.1-0ubuntu1","1:2014.1.1-0ubuntu1","1:2014.1.2-0ubuntu1"],"bundled":4}],"products":[{"vendor":"openstack","product":"horizon"},{"vendor":"opensuse","product":"opensuse"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2014/07/08/6","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","article","fix","web"]},{"url":"http://www.securityfocus.com/bid/68459","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://bugs.launchpad.net/horizon/+bug/1308727","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","advisory","report","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-01/msg00040.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","article","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3473","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0939","tags":["web","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2014:1188","tags":["web","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3473","tags":["web","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1116090","tags":["web","report"]},{"url":"https://github.com/openstack/horizon/commit/c844bd692894353c60b320005b804970605e910f","tags":["web"]},{"url":"https://github.com/openstack/horizon/commit/de4466d88b816437fb29eff5ab23b9b964cd3985","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8vwv-2v7v-jmgr","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-3473","tags":["advisory"]},{"url":"https://opendev.org/openstack/horizon","tags":["package"]},{"url":"https://pypi.org/project/horizon","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1042030","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1117901","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0939.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3473","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3474","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3474","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3474","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3475","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3475","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3475","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-8578","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-8578","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-8578","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1129774","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1188.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3594","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3594","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3594","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-3473","tags":["report"]},{"url":"https://marc.info/?l=oss-security\u0026m=140483587504490\u0026w=2","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2323-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-3474","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-3475","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-3594","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-3473","description":"Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when used with Heat, allows remote Orchestration template owners or catalogs to inject arbitrary web script or HTML via a crafted template.","status":"published","published":"2014-10-31T15:00:00Z","modified":"2024-08-06T10:43:06.106Z","updated_at":"2026-11-02T14:33:44.569327Z"}],"euvd":[{"id":"EUVD-2022-3247","description":"Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when used with Heat, allows remote Orchestration template owners or catalogs to inject arbitrary web script or HTML via a crafted template.","status":"published","published":"2014-10-31T15:00:00Z","modified":"2024-08-06T10:43:06Z","updated_at":"2026-11-03T01:57:10.446744Z"}],"ghsa":[{"id":"GHSA-8vwv-2v7v-jmgr","title":"Horizon-Orchestration Cross-site scripting (XSS) vulnerability through resource name","description":"Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when used with Heat, allows remote Orchestration template owners or catalogs to inject arbitrary web script or HTML via a crafted template.","status":"published","published":"2022-05-13T01:11:29Z","modified":"2023-10-19T17:46:51Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:08.847568Z"}],"nvd":[{"id":"CVE-2014-3473","description":"Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when used with Heat, allows remote Orchestration template owners or catalogs to inject arbitrary web script or HTML via a crafted template.","status":"published","published":"2014-10-31T15:55:03.743Z","modified":"2026-06-17T00:08:15.56Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:02:56.921017Z"}],"osv":[{"id":"CVE-2014-3473","description":"Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when used with Heat, allows remote Orchestration template owners or catalogs to inject arbitrary web script or HTML via a crafted template.","status":"published","published":"2014-10-31T15:55:03Z","modified":"2026-07-06T08:11:04.899232271Z","updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-3473","description":"Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when used with Heat, allows remote Orchestration template owners or catalogs to inject arbitrary web script or HTML via a crafted template.","status":"published","published":"2014-10-31T15:55:03.743Z","modified":"2026-10-23T15:47:28.714197992Z","updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"GHSA-8vwv-2v7v-jmgr","title":"Horizon-Orchestration Cross-site scripting (XSS) vulnerability through resource name","description":"Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when used with Heat, allows remote Orchestration template owners or catalogs to inject arbitrary web script or HTML via a crafted template.","status":"published","published":"2022-05-13T01:11:29Z","modified":"2026-07-06T08:11:04.899232271Z","cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:42.78452Z"},{"id":"PYSEC-2026-642","title":"Horizon-Orchestration Cross-site scripting (XSS) vulnerability through resource name","description":"Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when used with Heat, allows remote Orchestration template owners or catalogs to inject arbitrary web script or HTML via a crafted template.","status":"published","published":"2026-07-02T14:13:23.188473Z","modified":"2026-07-06T08:00:37.425165261Z","updated_at":"2026-11-02T15:52:57.671918Z"},{"id":"RHSA-2014:0939","title":"Red Hat Security Advisory: python-django-horizon security, bug fix, and enhancement update","status":"published","published":"2024-09-15T21:52:23Z","modified":"2026-08-01T10:30:09.868636278Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"RHSA-2014:1188","title":"Red Hat Security Advisory: python-django-horizon security update","status":"published","published":"2024-09-15T21:53:26Z","modified":"2026-08-01T10:30:29.534683851Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"UBUNTU-CVE-2014-3473","description":"Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when used with Heat, allows remote Orchestration template owners or catalogs to inject arbitrary web script or HTML via a crafted template.","status":"published","published":"2014-07-09T00:00:00Z","modified":"2026-02-04T04:25:19.793719Z","updated_at":"2026-11-02T15:54:09.010095Z"},{"id":"USN-2323-1","title":"horizon vulnerabilities","description":"Jason Hullinger discovered that OpenStack Horizon did not properly perform\ninput sanitization on Heat templates. If a user were tricked into using a\nspecially crafted Heat template, an attacker could conduct cross-site\nscripting attacks. With cross-site scripting vulnerabilities, if a user\nwere tricked into viewing server output during a crafted server request, a\nremote attacker could exploit this to modify the contents, or steal\nconfidential data, within the same domain. (CVE-2014-3473)\n\nCraig Lorentzen discovered that OpenStack Horizon did not properly perform\ninput sanitization when creating networks. If a user were tricked into\nlaunching an image using the crafted network name, an attacker could\nconduct cross-site scripting attacks. (CVE-2014-3474)\n\nMichael Xin discovered that OpenStack Horizon did not properly perform\ninput sanitization when adding users. If an admin user were tricked into\nviewing the users page containing a crafted email address, an attacker\ncould conduct cross-site scripting attacks. (CVE-2014-3475)\n\nDennis Felsch and Mario Heiderich discovered that OpenStack Horizon did not\nproperly perform input sanitization when creating host aggregates. If an\nadmin user were tricked into viewing the Host Aggregates page containing a\ncrafted availability zone name, an attacker could conduct cross-site\nscripting attacks. (CVE-2014-3594)\n","status":"published","published":"2014-08-21T20:51:32Z","modified":"2026-02-10T04:40:49Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}