{"id":"CVE-2017-7400","aliases":["DEBIAN-CVE-2017-7400","EUVD-2022-2332","GHSA-47vp-44v9-rhgq","PYSEC-2026-821","RHSA-2017:1598","RHSA-2017:1739","SUSE-SU-2017:1443-1","UBUNTU-CVE-2017-7400"],"status":"published","title":"OpenStack Horizon Cross-site Scripting (XSS)","description":"OpenStack Horizon 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0 allows remote authenticated administrators to conduct XSS attacks via a crafted federation mapping.","severity":{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01063,"percentile":0.64839,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2017-04-03T14:00:00Z","modified":"2026-10-24T10:30:21Z","fixes":[{"ecosystem":"PyPI","package":"horizon","fixed_in":["9.1.2","10.0.3","11.0.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"horizon","fixed_in":["3:10.0.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"horizon","fixed_in":["3:10.0.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"horizon","fixed_in":["3:10.0.1-1"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:10::el7","package":"openstack-dashboard","fixed_in":["1:10.0.3-6.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:10::el7","package":"openstack-dashboard-theme","fixed_in":["1:10.0.3-6.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:10::el7","package":"python-django-horizon","fixed_in":["1:10.0.3-6.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:9::el7","package":"openstack-dashboard","fixed_in":["1:9.0.1-13.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:9::el7","package":"openstack-dashboard-theme","fixed_in":["1:9.0.1-13.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:9::el7","package":"python-django-horizon","fixed_in":["1:9.0.1-13.el7ost"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0"},{"fixed":"9.1.2"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0"},{"fixed":"10.0.3"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"fixed":"11.0.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:10.0.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:10.0.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:10.0.1-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0"},{"fixed":"9.1.2"}]}]},{"source":"osv","ecosystem":"PyPI","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0"},{"fixed":"10.0.3"}]}]},{"source":"osv","ecosystem":"PyPI","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"fixed":"11.0.1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0"},{"fixed":"9.1.2"},{"introduced":"10.0"},{"fixed":"10.0.3"},{"introduced":"11.0.0"},{"fixed":"11.0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:10::el7","package":"openstack-dashboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.0.3-6.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:10::el7","package":"openstack-dashboard-theme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.0.3-6.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:10::el7","package":"python-django-horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.0.3-6.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:9::el7","package":"openstack-dashboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.1-13.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:9::el7","package":"openstack-dashboard-theme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.1-13.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:9::el7","package":"python-django-horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:9.0.1-13.el7ost"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"openstack-ceilometer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.4~a0~dev7-3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"openstack-ceilometer-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.4~a0~dev7-3.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"openstack-cinder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.5~a0~dev1-3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"openstack-cinder-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.5~a0~dev1-3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"openstack-dashboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.4~a0~dev2-3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"openstack-glance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.1~a0~dev6-3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"openstack-glance-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.0.1~a0~dev6-3.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"openstack-heat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.4~a0~dev4-4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"openstack-heat-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.4~a0~dev4-4.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.2~a0~dev2-6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"openstack-keystone-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.2~a0~dev2-6.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"openstack-magnum","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2~a0~dev22-13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"openstack-magnum-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2~a0~dev22-13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"openstack-manila","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1~a0~dev27-3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"openstack-manila-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1~a0~dev27-3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.6~a0~dev16-3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"openstack-nova-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.0.6~a0~dev16-3.3"}]}],"bundled":2}],"products":[{"vendor":"openstack","product":"horizon"}],"references":[{"url":"http://www.securityfocus.com/bid/97324","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://launchpad.net/bugs/1667086","tags":["x_refsource_CONFIRM","x_transferred","web","report"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1598","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1739","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-7400","tags":["advisory"]},{"url":"https://opendev.org/openstack/horizon/commit/1407cfe53144146b29679de21f28c952282043ae","tags":["web"]},{"url":"https://opendev.org/openstack/horizon/commit/511b325b45b6bd7a88bb6df1a4639b80d0121277","tags":["web"]},{"url":"https://opendev.org/openstack/horizon/commit/a835dbfbaa2c70329c08d4b8429d49315dc6d651","tags":["web"]},{"url":"https://opendev.org/openstack/horizon/commit/ce80bb6fec3cb0262728e7ae8b9d695cf832e5bf","tags":["web"]},{"url":"https://github.com/advisories/GHSA-47vp-44v9-rhgq","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-7400","tags":["advisory"]},{"url":"https://pypi.org/project/horizon","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1408777","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1414997","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1427328","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1432036","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1432245","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1432289","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1439626","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1454330","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1598.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-7400","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-7400","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1457745","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1739.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171443-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1024328","tags":["report"]},{"url":"https://bugzilla.suse.com/1030406","tags":["report"]},{"url":"https://bugzilla.suse.com/1032322","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7400","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-7400","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-7400","description":"OpenStack Horizon 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0 allows remote authenticated administrators to conduct XSS attacks via a crafted federation mapping.","status":"published","published":"2017-04-03T14:00:00Z","modified":"2024-08-05T16:04:10.618Z","updated_at":"2026-11-02T14:33:20.843976Z"}],"euvd":[{"id":"EUVD-2022-2332","description":"OpenStack Horizon 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0 allows remote authenticated administrators to conduct XSS attacks via a crafted federation mapping.","status":"published","published":"2017-04-03T14:00:00Z","modified":"2024-08-05T16:04:10Z","updated_at":"2026-11-03T02:39:08.461482Z"}],"ghsa":[{"id":"GHSA-47vp-44v9-rhgq","title":"OpenStack Horizon Cross-site Scripting (XSS)","description":"OpenStack Horizon 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0 allows remote authenticated administrators to conduct XSS attacks via a crafted federation mapping.","status":"published","published":"2022-05-14T03:53:47Z","modified":"2024-05-14T21:28:08Z","cvss":[{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:48.848211Z"}],"nvd":[{"id":"CVE-2017-7400","description":"OpenStack Horizon 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0 allows remote authenticated administrators to conduct XSS attacks via a crafted federation mapping.","status":"published","published":"2017-04-03T14:59:00.167Z","modified":"2026-06-17T01:24:16.537Z","cvss":[{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:03:44.86906Z"}],"osv":[{"id":"CVE-2017-7400","description":"OpenStack Horizon 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0 allows remote authenticated administrators to conduct XSS attacks via a crafted federation mapping.","status":"published","published":"2017-04-03T14:59:00.167Z","modified":"2026-10-24T10:30:21.384982372Z","cvss":[{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:06.412595Z"},{"id":"DEBIAN-CVE-2017-7400","description":"OpenStack Horizon 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0 allows remote authenticated administrators to conduct XSS attacks via a crafted federation mapping.","status":"published","published":"2017-04-03T14:59:00.167Z","modified":"2026-09-10T06:00:06.046944509Z","cvss":[{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:29.412243Z"},{"id":"GHSA-47vp-44v9-rhgq","title":"OpenStack Horizon Cross-site Scripting (XSS)","description":"OpenStack Horizon 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0 allows remote authenticated administrators to conduct XSS attacks via a crafted federation mapping.","status":"published","published":"2022-05-14T03:53:47Z","modified":"2026-07-07T11:56:09.035463651Z","cvss":[{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:36.782754Z"},{"id":"PYSEC-2026-821","title":"OpenStack Horizon Cross-site Scripting (XSS)","description":"OpenStack Horizon 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0 allows remote authenticated administrators to conduct XSS attacks via a crafted federation mapping.","status":"published","published":"2026-07-06T08:03:24.141443Z","modified":"2026-07-07T11:46:03.571983814Z","cvss":[{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:58.117212Z"},{"id":"RHSA-2017:1598","title":"Red Hat Security Advisory: python-django-horizon security, bug fix, and enhancement update","status":"published","published":"2024-09-13T11:59:22Z","modified":"2026-06-29T10:16:44Z","cvss":[{"version":"3.0","score":3.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"RHSA-2017:1739","title":"Red Hat Security Advisory: python-django-horizon security and bug fix update","status":"published","published":"2024-09-13T11:59:21Z","modified":"2026-06-29T10:16:53Z","cvss":[{"version":"3.0","score":3.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"UBUNTU-CVE-2017-7400","description":"OpenStack Horizon 9.x through 9.1.1, 10.x through 10.0.2, and 11.0.0 allows remote authenticated administrators to conduct XSS attacks via a crafted federation mapping.","status":"withdrawn","published":"2017-04-03T14:59:00Z","modified":"2025-07-16T08:13:25.942836Z","cvss":[{"version":"3.0","score":4.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:15.773974Z"},{"id":"SUSE-SU-2017:1443-1","title":"Security update for several openstack-components","description":"\nThis update for openstack-ceilometer, -cinder, -dashboard, -glance, -heat, -keystone, -manila, -magnum and \n-novaopenstack-keystone provides the latest code from OpenStack Newton.\n\n- nova: Add release note that legacy notification exception contexts appearing in ERROR level logs may include sensitive\n  information such as account passwords and authorization tokens. (bsc#1030406, CVE-2017-7214)\n- nova: Remove PrivTmp from openstack-nova-compute service. (bsc#1024328)\n- dashboard: Remove dangerous safestring declaration. (bsc#1032322, CVE-2017-7400)\n","status":"published","published":"2017-05-30T11:22:13Z","modified":"2026-02-04T02:57:31.870938Z","updated_at":"2026-11-02T15:53:43.83457Z"}]}}