{"id":"CVE-2016-4428","aliases":["DEBIAN-CVE-2016-4428","DLA-520-1","DSA-3617-1","EUVD-2022-4001","GHSA-grm6-x6mr-q3cv","PYSEC-2026-643","RHSA-2016:1268","RHSA-2016:1269","RHSA-2016:1270","RHSA-2016:1271","RHSA-2016:1272","SUSE-SU-2016:2143-1","UBUNTU-CVE-2016-4428","USN-3447-1"],"status":"published","title":"OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability","description":"Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02085,"percentile":0.81693,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2016-06-18T00:00:00Z","modified":"2026-10-24T10:30:58Z","fixes":[{"ecosystem":"PyPI","package":"horizon","fixed_in":["8.0.2","9.1.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"horizon","fixed_in":["3:9.0.1-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"horizon","fixed_in":["3:9.0.1-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"horizon","fixed_in":["3:9.0.1-2"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"horizon","fixed_in":["2012.1.1-10+deb7u1"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"openstack-dashboard","fixed_in":["0:2014.1.5-4.el6ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"openstack-dashboard-theme","fixed_in":["0:2014.1.5-4.el6ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"python-django-horizon","fixed_in":["0:2014.1.5-4.el6ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el6","package":"python-django-horizon-doc","fixed_in":["0:2014.1.5-4.el6ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"openstack-dashboard","fixed_in":["0:2014.1.5-4.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"openstack-dashboard-theme","fixed_in":["0:2014.1.5-4.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"python-django-horizon","fixed_in":["0:2014.1.5-4.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:5::el7","package":"python-django-horizon-doc","fixed_in":["0:2014.1.5-4.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:8::el7","package":"openstack-dashboard","fixed_in":["1:8.0.1-4.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:8::el7","package":"openstack-dashboard-theme","fixed_in":["1:8.0.1-4.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:8::el7","package":"python-django-horizon","fixed_in":["1:8.0.1-4.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"openstack-dashboard","fixed_in":["0:2014.2.3-9.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"openstack-dashboard-theme","fixed_in":["0:2014.2.3-9.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"python-django-horizon","fixed_in":["0:2014.2.3-9.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:6::el7","package":"python-django-horizon-doc","fixed_in":["0:2014.2.3-9.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"openstack-dashboard","fixed_in":["0:2015.1.4-1.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"openstack-dashboard-theme","fixed_in":["0:2015.1.4-1.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"python-django-horizon","fixed_in":["0:2015.1.4-1.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:7::el7","package":"python-django-horizon-doc","fixed_in":["0:2015.1.4-1.el7ost"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"horizon","fixed_in":["1:2014.1.5-0ubuntu2.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"8.0.1"},{"fixed":"8.0.2"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"last_affected":"9.0.1"},{"fixed":"9.1.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:9.0.1-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:9.0.1-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:9.0.1-2"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2012.1.1-10+deb7u1"}]}],"versions":["2012.1.1-10"]},{"source":"osv","ecosystem":"Debian:8","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2014.1.3-7+deb8u2"}]}],"versions":["2014.1.3-7"],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.2"}]}]},{"source":"osv","ecosystem":"PyPI","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.1.0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.2"},{"introduced":"9.0.0"},{"fixed":"9.1.0"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"openstack-dashboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.5-4.el6ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"openstack-dashboard-theme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.5-4.el6ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"python-django-horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.5-4.el6ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"python-django-horizon-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.5-4.el6ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"openstack-dashboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.5-4.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"openstack-dashboard-theme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.5-4.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"python-django-horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.5-4.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"python-django-horizon-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.1.5-4.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:8::el7","package":"openstack-dashboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.0.1-4.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:8::el7","package":"openstack-dashboard-theme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.0.1-4.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:8::el7","package":"python-django-horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.0.1-4.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"openstack-dashboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.2.3-9.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"openstack-dashboard-theme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.2.3-9.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"python-django-horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.2.3-9.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"python-django-horizon-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2014.2.3-9.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"openstack-dashboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2015.1.4-1.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"openstack-dashboard-theme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2015.1.4-1.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"python-django-horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2015.1.4-1.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"python-django-horizon-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2015.1.4-1.el7ost"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-ceilometer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.4~a0~dev6-6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-ceilometer-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.4~a0~dev6-6.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.3~a0~dev2-7.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-cinder-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.3~a0~dev2-7.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-dashboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.2~a0~dev34-8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.2~a0~dev13-7.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-glance-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.2~a0~dev13-7.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2~a0~dev93-9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-heat-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.2~a0~dev93-9.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.1~a0~dev13-3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-keystone-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.1~a0~dev13-3.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-manila","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2~a0~dev11-9.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-manila-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2~a0~dev11-9.2"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-neutron","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2~a0~dev29-10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-neutron-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2~a0~dev29-10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-neutron-fwaas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2~a0~dev1-6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-neutron-fwaas-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2~a0~dev1-6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-neutron-lbaas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2~a0~dev1-6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-neutron-lbaas-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2~a0~dev1-6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.5~a0~dev2-7.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-nova-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.5~a0~dev2-7.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"openstack-resource-agents","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0+git.1467079370.4f2c49d-7.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"python-networking-cisco","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"python-openstackclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.2-4.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2014.1.5-0ubuntu2.1"}]}],"versions":["1:2013.2~rc3-0ubuntu1","1:2013.2-0ubuntu1","1:2014.1~b1-0ubuntu1","1:2014.1~b2-0ubuntu1","1:2014.1~b2-0ubuntu2","1:2014.1~b3-0ubuntu1","1:2014.1~b3-0ubuntu2","1:2014.1~rc1-0ubuntu1","1:2014.1~rc2-0ubuntu1","1:2014.1-0ubuntu1","1:2014.1.1-0ubuntu1","1:2014.1.2-0ubuntu1","1:2014.1.2-0ubuntu1.1","1:2014.1.3-0ubuntu1","1:2014.1.3-0ubuntu2","1:2014.1.4-0ubuntu2","1:2014.1.5-0ubuntu1","1:2014.1.5-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2014.1.5-0ubuntu2.1"}]}],"versions":["1:2013.2~rc3-0ubuntu1","1:2013.2-0ubuntu1","1:2014.1~b1-0ubuntu1","1:2014.1~b2-0ubuntu1","1:2014.1~b2-0ubuntu2","1:2014.1~b3-0ubuntu1","1:2014.1~b3-0ubuntu2","1:2014.1~rc1-0ubuntu1","1:2014.1~rc2-0ubuntu1","1:2014.1-0ubuntu1","1:2014.1.1-0ubuntu1","1:2014.1.2-0ubuntu1","1:2014.1.2-0ubuntu1.1","1:2014.1.3-0ubuntu1","1:2014.1.3-0ubuntu2","1:2014.1.4-0ubuntu2","1:2014.1.5-0ubuntu1","1:2014.1.5-0ubuntu2"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"openstack","product":"horizon"},{"vendor":"redhat","product":"openstack"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2016:1268","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2016:1270","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.debian.org/security/2016/dsa-3617","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2016:1272","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.openstack.org/ossa/OSSA-2016-010.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","web"]},{"url":"https://review.openstack.org/329997","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","web"]},{"url":"https://bugs.launchpad.net/horizon/+bug/1567673","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://access.redhat.com/errata/RHSA-2016:1269","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2016/06/17/4","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","fix","web"]},{"url":"https://access.redhat.com/errata/RHSA-2016:1271","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://review.openstack.org/329998","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","web"]},{"url":"https://review.openstack.org/329996","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4428","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-4428","tags":["web","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1343982","tags":["web","report"]},{"url":"https://github.com/openstack/horizon/commit/62b4e6f30a7ae7961805abdffdb3c7ae5c2b676a","tags":["web"]},{"url":"https://github.com/openstack/horizon/commit/d585e5eb9acf92d10d39b6c2038917a7e8ac71bb","tags":["web"]},{"url":"https://github.com/openstack/horizon/commit/fc8d70560401f3985e5672a4c580f10d51e985a4","tags":["web"]},{"url":"https://github.com/advisories/GHSA-grm6-x6mr-q3cv","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-4428","tags":["advisory"]},{"url":"https://pypi.org/project/horizon","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1268.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4428","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1269.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1270.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1238092","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1293232","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1271.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1287881","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1272.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162143-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/970258","tags":["report"]},{"url":"https://bugzilla.suse.com/982426","tags":["report"]},{"url":"https://bugzilla.suse.com/983807","tags":["report"]},{"url":"https://bugzilla.suse.com/984442","tags":["report"]},{"url":"https://bugzilla.suse.com/984443","tags":["report"]},{"url":"https://bugzilla.suse.com/988729","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2140","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4428","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5363","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-4428","tags":["report"]},{"url":"http://seclists.org/oss-sec/2016/q2/565","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3447-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2016-4428","description":"Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.","status":"published","published":"2016-07-12T19:00:00Z","modified":"2024-08-06T00:32:24.621Z","updated_at":"2026-11-02T14:33:34.815789Z"}],"euvd":[{"id":"EUVD-2022-4001","description":"Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.","status":"published","published":"2016-07-12T19:00:00Z","modified":"2024-08-06T00:32:24Z","updated_at":"2026-11-03T02:22:46.329763Z"}],"ghsa":[{"id":"GHSA-grm6-x6mr-q3cv","title":"OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability","description":"Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.","status":"published","published":"2022-05-13T01:07:34Z","modified":"2024-05-14T17:25:12Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:48.848211Z"}],"nvd":[{"id":"CVE-2016-4428","description":"Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.","status":"published","published":"2016-07-12T19:59:03.257Z","modified":"2026-06-17T00:47:32.233Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:03:27.736698Z"}],"osv":[{"id":"CVE-2016-4428","description":"Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.","status":"published","published":"2016-07-12T19:59:03.257Z","modified":"2026-10-24T10:30:58.271778011Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:02.454775Z"},{"id":"DEBIAN-CVE-2016-4428","description":"Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.","status":"published","published":"2016-07-12T19:59:03.257Z","modified":"2026-09-22T07:02:00.713601353Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:27.627285Z"},{"id":"GHSA-grm6-x6mr-q3cv","title":"OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability","description":"Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.","status":"published","published":"2022-05-13T01:07:34Z","modified":"2026-07-06T08:11:17.944818426Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:48.191583Z"},{"id":"PYSEC-2026-643","title":"OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability","description":"Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.","status":"published","published":"2026-07-02T14:13:22.820828Z","modified":"2026-07-06T08:00:37.654180143Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:57.671918Z"},{"id":"UBUNTU-CVE-2016-4428","description":"Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.","status":"published","published":"2016-07-12T00:00:00Z","modified":"2026-02-04T02:34:16.673022Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:12.261906Z"},{"id":"DLA-520-1","title":"horizon - security update","status":"published","published":"2016-06-18T00:00:00Z","modified":"2026-03-09T02:11:05.630666Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3617-1","title":"horizon - security update","status":"published","published":"2016-07-06T00:00:00Z","modified":"2026-03-09T01:21:01.427915Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"RHSA-2016:1268","title":"Red Hat Security Advisory: python-django-horizon security update","status":"published","published":"2024-09-13T11:03:45Z","modified":"2026-06-29T10:12:44Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:1269","title":"Red Hat Security Advisory: python-django-horizon security update","status":"published","published":"2024-09-13T11:03:52Z","modified":"2026-06-29T10:12:44Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:1270","title":"Red Hat Security Advisory: python-django-horizon security update","status":"published","published":"2024-09-13T11:04:08Z","modified":"2026-06-29T10:12:45Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:1271","title":"Red Hat Security Advisory: python-django-horizon security and bug fix update","status":"published","published":"2024-09-13T11:03:58Z","modified":"2026-06-29T10:12:45Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:1272","title":"Red Hat Security Advisory: python-django-horizon security, bug fix, and enhancement update","status":"published","published":"2024-09-13T11:04:02Z","modified":"2026-06-29T10:12:46Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"SUSE-SU-2016:2143-1","title":"Security update for several openstack-components","description":"\nThis update provides the latest code from OpenStack Liberty for openstack-ceilometer, -cinder, \n-dashboard, -glance, -heat, -keystone, -manila, -neutron, -neutron-fwaas, -neutron-lbaas,-nova,\n-resource-agents, python-networking-cisco and python-openstackclient.\n\nAdditionally some security-issues have been fixed:\n\nopenstack-nova:\n\n- Always copy or recreate disk.info during a migration. (bsc#970258, CVE-2016-2140)\n\nopenstack-dashboard:\n\n- Escape anularjs templating in unsafe HTML. (bsc#983807, CVE-2016-4428)\n\nopenstack-neutron:\n\n- Fix bypassing of anti-spoof protection. (bsc#984443, CVE-2016-5363, bsc#984442, CVE-2016-5362)\n\nFor a detailed description of all fixes and improvements, please refer to the changelog.\n","status":"published","published":"2016-08-23T15:49:42Z","modified":"2026-02-04T02:53:18.835356Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"USN-3447-1","title":"horizon vulnerability","description":"Beth Lancaster and Brandon Sawyers discovered that OpenStack Horizon was\nincorrect protected against cross-site scripting (XSS) attacks. A remote\nauthenticated user could use this issue to inject web script or HTML in\na dashboard form.\n","status":"published","published":"2017-10-11T11:31:23Z","modified":"2026-02-10T04:41:13Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}