{"id":"CVE-2014-8124","aliases":["DEBIAN-CVE-2014-8124","EUVD-2014-7968","GHSA-q878-vxpg-6qx6","RHSA-2015:0839","RHSA-2015:0845","SUSE-RU-2015:0410-1","UBUNTU-CVE-2014-8124"],"status":"published","title":"OpenStack Dashboard (Horizon) before 2014.1.3 and 2014.2.x before 2014.2.1 does not properly...","description":"OpenStack Dashboard (Horizon) before 2014.1.3 and 2014.2.x before 2014.2.1 does not properly handle session records when using a db or memcached session engine, which allows remote attackers to cause a denial of service via a large number of requests to the login page.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02944,"percentile":0.87232,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2014-08-28T12:06:29Z","modified":"2026-10-23T15:47:32Z","fixes":[{"ecosystem":"Debian:12","package":"horizon","fixed_in":["2014.1.3-6"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"horizon","fixed_in":["2014.1.3-6"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"horizon","fixed_in":["2014.1.3-6"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"openstack-dashboard","fixed_in":["0:2014.1.4-1.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"openstack-dashboard-theme","fixed_in":["0:2014.1.4-1.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"python-django-horizon","fixed_in":["0:2014.1.4-1.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"python-django-horizon-doc","fixed_in":["0:2014.1.4-1.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"python-django-openstack-auth","fixed_in":["0:1.1.5-4.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"openstack-dashboard","fixed_in":["0:2014.1.4-1.el6ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"openstack-dashboard-theme","fixed_in":["0:2014.1.4-1.el6ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"python-django-horizon","fixed_in":["0:2014.1.4-1.el6ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"python-django-horizon-doc","fixed_in":["0:2014.1.4-1.el6ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"python-django-openstack-auth","fixed_in":["0:1.1.5-4.el6ost"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"horizon","fixed_in":["1:2014.1.4-0ubuntu2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2014.1.3-6"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2014.1.3-6"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2014.1.3-6"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"openstack-dashboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.4-1.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"openstack-dashboard-theme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.4-1.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"python-django-horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.4-1.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"python-django-horizon-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.4-1.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"python-django-openstack-auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.5-4.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"openstack-dashboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.4-1.el6ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"openstack-dashboard-theme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.4-1.el6ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"python-django-horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.4-1.el6ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"python-django-horizon-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.4-1.el6ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"python-django-openstack-auth","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.5-4.el6ost"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2014.1.4-0ubuntu2"}]}],"versions":["1:2013.2~rc3-0ubuntu1","1:2013.2-0ubuntu1","1:2014.1~b1-0ubuntu1","1:2014.1~b2-0ubuntu1","1:2014.1~b2-0ubuntu2","1:2014.1~b3-0ubuntu1","1:2014.1~b3-0ubuntu2","1:2014.1~rc1-0ubuntu1","1:2014.1~rc2-0ubuntu1","1:2014.1-0ubuntu1","1:2014.1.1-0ubuntu1","1:2014.1.2-0ubuntu1","1:2014.1.2-0ubuntu1.1","1:2014.1.3-0ubuntu1","1:2014.1.3-0ubuntu2"]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"openstack","product":"horizon"},{"vendor":"opensuse","product":"opensuse"},{"vendor":"oracle","product":"solaris"}],"references":[{"url":"https://bugs.launchpad.net/horizon/+bug/1394370","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","advisory","report"]},{"url":"http://secunia.com/advisories/61186","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0845.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Broken Link","advisory"]},{"url":"http://lists.openstack.org/pipermail/openstack-announce/2014-December/000308.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch","Vendor Advisory","advisory","fix","report"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147520.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0839.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Broken Link","advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-01/msg00040.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-8124","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2015:0839","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2015:0845","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-8124","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1169637","tags":["report"]},{"url":"https://github.com/advisories/GHSA-q878-vxpg-6qx6"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-8124","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux_OpenStack_Platform/5/html/Release_Notes/index.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1112621","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1168575","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1192517","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1203281","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0839.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-8124","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1203231","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0845.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement//suse-ru-20150410-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/891815","tags":["report"]},{"url":"https://bugzilla.suse.com/891904","tags":["report"]},{"url":"https://bugzilla.suse.com/897815","tags":["report"]},{"url":"https://bugzilla.suse.com/908199","tags":["report"]},{"url":"https://bugzilla.suse.com/910008","tags":["report"]},{"url":"https://bugzilla.suse.com/913692","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8124","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2014-8124","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-8124","description":"OpenStack Dashboard (Horizon) before 2014.1.3 and 2014.2.x before 2014.2.1 does not properly handle session records when using a db or memcached session engine, which allows remote attackers to cause a denial of service via a large number of requests to the login page.","status":"published","published":"2014-12-12T15:00:00Z","modified":"2024-08-06T13:10:50.827Z","updated_at":"2026-11-02T14:33:43.206348Z"}],"euvd":[{"id":"EUVD-2014-7968","description":"OpenStack Dashboard (Horizon) before 2014.1.3 and 2014.2.x before 2014.2.1 does not properly handle session records when using a db or memcached session engine, which allows remote attackers to cause a denial of service via a large number of requests to the login page.","status":"published","published":"2014-12-12T15:00:00Z","modified":"2024-08-06T13:10:50Z","updated_at":"2026-11-03T01:56:52.951821Z"}],"ghsa":[{"id":"GHSA-q878-vxpg-6qx6","title":"OpenStack Dashboard (Horizon) before 2014.1.3 and 2014.2.x before 2014.2.1 does not properly...","description":"OpenStack Dashboard (Horizon) before 2014.1.3 and 2014.2.x before 2014.2.1 does not properly handle session records when using a db or memcached session engine, which allows remote attackers to cause a denial of service via a large number of requests to the login page.","status":"published","published":"2022-05-13T01:11:27Z","modified":"2023-02-10T05:06:05Z","cwes":["CWE-400"],"updated_at":"2026-11-02T14:54:00.716708Z"}],"nvd":[{"id":"CVE-2014-8124","description":"OpenStack Dashboard (Horizon) before 2014.1.3 and 2014.2.x before 2014.2.1 does not properly handle session records when using a db or memcached session engine, which allows remote attackers to cause a denial of service via a large number of requests to the login page.","status":"published","published":"2014-12-12T15:59:09.557Z","modified":"2026-06-17T00:16:19.593Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:02:57.680258Z"}],"osv":[{"id":"CVE-2014-8124","description":"OpenStack Dashboard (Horizon) before 2014.1.3 and 2014.2.x before 2014.2.1 does not properly handle session records when using a db or memcached session engine, which allows remote attackers to cause a denial of service via a large number of requests to the login page.","status":"published","published":"2014-12-12T15:59:09Z","modified":"2026-04-10T03:44:04.778577Z","updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-8124","description":"OpenStack Dashboard (Horizon) before 2014.1.3 and 2014.2.x before 2014.2.1 does not properly handle session records when using a db or memcached session engine, which allows remote attackers to cause a denial of service via a large number of requests to the login page.","status":"published","published":"2014-12-12T15:59:09.557Z","modified":"2026-10-23T15:47:32.15641285Z","updated_at":"2026-11-02T15:45:26.442161Z"},{"id":"RHSA-2015:0839","title":"Red Hat Security Advisory: python-django-horizon and python-django-openstack-auth update","status":"published","published":"2024-09-15T22:21:28Z","modified":"2026-08-08T10:15:08.166220738Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"RHSA-2015:0845","title":"Red Hat Security Advisory: python-django-horizon and python-django-openstack-auth update","status":"published","published":"2024-09-15T22:21:23Z","modified":"2026-08-08T10:15:07.055739781Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"SUSE-RU-2015:0410-1","title":"Security update for openstack-dashboard","description":"\nThis update for openstack-dashboard fixes a cross-site scripting issue on \nthe unordered_list filter. (bnc#891815, CVE-2014-3594)\n\nSecurity Issues:\n\n    * CVE-2014-3475\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3475\u003e\n\n","status":"published","published":"2014-08-28T12:06:29Z","modified":"2026-02-04T03:59:04.529562Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"UBUNTU-CVE-2014-8124","description":"OpenStack Dashboard (Horizon) before 2014.1.3 and 2014.2.x before 2014.2.1 does not properly handle session records when using a db or memcached session engine, which allows remote attackers to cause a denial of service via a large number of requests to the login page.","status":"published","published":"2014-12-12T15:59:00Z","modified":"2025-07-16T07:32:14.964948Z","updated_at":"2026-11-02T15:54:09.378953Z"}]}}