{"id":"CVE-2020-29565","aliases":["DEBIAN-CVE-2020-29565","DSA-4820-1","EUVD-2020-0084","GHSA-f8fh-xp28-q59m","PYSEC-2020-45","RHSA-2020:5411","RHSA-2020:5572","SUSE-SU-2021:0099-1","UBUNTU-CVE-2020-29565","USN-4675-1"],"status":"published","title":"OpenStack Horizon Open redirect in workflow forms","description":"An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the \"next\" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01423,"percentile":0.73081,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-601"],"published":"2020-12-04T07:06:03Z","modified":"2026-10-26T12:02:49Z","fixes":[{"ecosystem":"PyPI","package":"horizon","fixed_in":["15.3.2","16.2.1","18.3.3","18.6.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"horizon","fixed_in":["3:18.6.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"horizon","fixed_in":["3:18.6.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"horizon","fixed_in":["3:18.6.1-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"horizon","fixed_in":["3:14.0.2-3+deb10u2"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-dashboard","fixed_in":["1:16.2.1-1.20201114033610.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"python-django-horizon","fixed_in":["1:16.2.1-1.20201114033610.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:16.1::el8","package":"python3-django-horizon","fixed_in":["1:16.2.1-1.20201114033610.el8ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:13::el7","package":"openstack-dashboard","fixed_in":["1:13.0.3-7.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:13::el7","package":"python-django-horizon","fixed_in":["1:13.0.3-7.el7ost"],"sources":["osv"]},{"ecosystem":"SUSE:HPE Helion OpenStack 8","package":"openstack-dashboard","fixed_in":["12.0.5~dev6-3.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:HPE Helion OpenStack 8","package":"release-notes-hpe-helion-openstack","fixed_in":["8.20201214-3.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 8","package":"openstack-dashboard","fixed_in":["12.0.5~dev6-3.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 8","package":"release-notes-suse-openstack-cloud","fixed_in":["8.20201214-3.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"openstack-dashboard","fixed_in":["12.0.5~dev6-3.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"release-notes-suse-openstack-cloud","fixed_in":["8.20201214-3.26.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"horizon","fixed_in":["2:9.1.2-0ubuntu5.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"horizon","fixed_in":["3:13.0.3-0ubuntu2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"horizon","fixed_in":["3:18.3.2-0ubuntu0.20.04.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.3.2"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.0"},{"fixed":"16.2.1"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.0.0"},{"fixed":"18.3.3"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.4.0"},{"fixed":"18.6.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:18.6.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:18.6.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:18.6.1-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:14.0.2-3+deb10u2"}]}],"versions":["3:14.0.2-3"]},{"source":"osv","ecosystem":"PyPI","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.3.2"}]}],"versions":["12.0.2","12.0.3","12.0.4","13.0.0","13.0.0.0b3","13.0.0.0rc1","13.0.0.0rc2","13.0.1","13.0.2","13.0.3","14.0.0","14.0.0.0b1","14.0.0.0b2","14.0.0.0b3","14.0.0.0rc1","14.0.0.0rc2","14.0.1","14.0.2","14.0.3","14.0.4","14.1.0","15.0.0","15.0.0.0b1","15.0.0.0b2","15.0.0.0rc1","15.0.0.0rc2","15.1.0","15.1.1","15.2.0","15.3.0","15.3.1"]},{"source":"osv","ecosystem":"PyPI","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.0.0"},{"fixed":"16.2.1"}]}],"versions":["16.0.0","16.1.0","16.2.0"]},{"source":"osv","ecosystem":"PyPI","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.0.0"},{"fixed":"18.3.3"}]}],"versions":["17.0.0","17.1.0","18.0.0","18.1.0","18.2.0","18.3.0","18.3.1","18.3.2"]},{"source":"osv","ecosystem":"PyPI","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.4.0"},{"fixed":"18.6.0"}]}],"versions":["18.4.0","18.4.1","18.5.0"]},{"source":"osv","ecosystem":"PyPI","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15.3.0"},{"fixed":"15.3.2"},{"introduced":"16.0.0"},{"fixed":"16.2.1"},{"introduced":"17.0.0"},{"fixed":"18.3.3"},{"introduced":"18.4.0"},{"fixed":"18.6.0"}]}],"versions":["15.3.0","15.3.1","16.0.0","16.1.0","16.2.0","17.0.0","17.1.0","18.0.0","18.1.0","18.2.0","18.3.0","18.3.1","18.3.2","18.4.0","18.4.1","18.5.0"]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"openstack-dashboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.2.1-1.20201114033610.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"python-django-horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.2.1-1.20201114033610.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"python3-django-horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.2.1-1.20201114033610.el8ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:13::el7","package":"openstack-dashboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:13.0.3-7.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:13::el7","package":"python-django-horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:13.0.3-7.el7ost"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"openstack-dashboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.5~dev6-3.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"release-notes-hpe-helion-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20201214-3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"openstack-dashboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.5~dev6-3.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"release-notes-suse-openstack-cloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20201214-3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"openstack-dashboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.5~dev6-3.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"release-notes-suse-openstack-cloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.20201214-3.26.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.1.2-0ubuntu5.2"}]}],"versions":["2:8.0.0-0ubuntu2","2:9.0.0~b1-0ubuntu1","2:9.0.0~b1-0ubuntu2","2:9.0.0~b2-0ubuntu1","2:9.0.0~b3-0ubuntu1","2:9.0.0~rc1-0ubuntu1","2:9.0.0-0ubuntu1","2:9.0.0-0ubuntu2","2:9.0.0-0ubuntu2.16.04.1","2:9.0.1-0ubuntu2","2:9.1.0-0ubuntu1","2:9.1.1-0ubuntu1","2:9.1.2-0ubuntu1","2:9.1.2-0ubuntu2","2:9.1.2-0ubuntu3","2:9.1.2-0ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.0.3-0ubuntu2"}]}],"versions":["3:12.0.0-0ubuntu2.1","3:12.0.0-0ubuntu3","3:13.0.0~b1-0ubuntu1","3:13.0.0~b1-0ubuntu2","3:13.0.0-0ubuntu1","3:13.0.0-0ubuntu1.1","3:13.0.1-0ubuntu1","3:13.0.1-0ubuntu2","3:13.0.1-0ubuntu3","3:13.0.1-0ubuntu4","3:13.0.1-0ubuntu5","3:13.0.1-0ubuntu6","3:13.0.2-0ubuntu1","3:13.0.2-0ubuntu2","3:13.0.2-0ubuntu3","3:13.0.3-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:18.3.2-0ubuntu0.20.04.4"}]}],"versions":["3:16.0.0-0ubuntu1","3:17.0.0~b1~git2019121712.f7313b74c-0ubuntu1","3:18.0.1~git2020021409.bb959361b-0ubuntu2","3:18.0.1~git2020021409.bb959361b-0ubuntu3","3:18.2.1~git2020032709.2c4470272-0ubuntu1","3:18.2.1~git2020041013.754804667-0ubuntu1","3:18.2.1~git2020041013.754804667-0ubuntu2","3:18.2.1~git2020041013.754804667-0ubuntu3","3:18.3.2-0ubuntu0.20.04.1","3:18.3.2-0ubuntu0.20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:9.1.2-0ubuntu5.2"}]}],"versions":["2:8.0.0-0ubuntu2","2:9.0.0~b1-0ubuntu1","2:9.0.0~b1-0ubuntu2","2:9.0.0~b2-0ubuntu1","2:9.0.0~b3-0ubuntu1","2:9.0.0~rc1-0ubuntu1","2:9.0.0-0ubuntu1","2:9.0.0-0ubuntu2","2:9.0.0-0ubuntu2.16.04.1","2:9.0.1-0ubuntu2","2:9.1.0-0ubuntu1","2:9.1.1-0ubuntu1","2:9.1.2-0ubuntu1","2:9.1.2-0ubuntu2","2:9.1.2-0ubuntu3","2:9.1.2-0ubuntu5"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:13.0.3-0ubuntu2"}]}],"versions":["3:12.0.0-0ubuntu2.1","3:12.0.0-0ubuntu3","3:13.0.0~b1-0ubuntu1","3:13.0.0~b1-0ubuntu2","3:13.0.0-0ubuntu1","3:13.0.0-0ubuntu1.1","3:13.0.1-0ubuntu1","3:13.0.1-0ubuntu2","3:13.0.1-0ubuntu3","3:13.0.1-0ubuntu4","3:13.0.1-0ubuntu5","3:13.0.1-0ubuntu6","3:13.0.2-0ubuntu1","3:13.0.2-0ubuntu2","3:13.0.2-0ubuntu3","3:13.0.3-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"horizon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:18.3.2-0ubuntu0.20.04.4"}]}],"versions":["3:16.0.0-0ubuntu1","3:17.0.0~b1~git2019121712.f7313b74c-0ubuntu1","3:18.0.1~git2020021409.bb959361b-0ubuntu2","3:18.0.1~git2020021409.bb959361b-0ubuntu3","3:18.2.1~git2020032709.2c4470272-0ubuntu1","3:18.2.1~git2020041013.754804667-0ubuntu1","3:18.2.1~git2020041013.754804667-0ubuntu2","3:18.2.1~git2020041013.754804667-0ubuntu3","3:18.3.2-0ubuntu0.20.04.1","3:18.3.2-0ubuntu0.20.04.2"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"openstack","product":"horizon"}],"references":[{"url":"https://bugs.launchpad.net/horizon/+bug/1865026","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://review.opendev.org/c/openstack/horizon/+/758841/","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://review.opendev.org/c/openstack/horizon/+/758843/","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://security.openstack.org/ossa/OSSA-2020-008.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","web"]},{"url":"http://www.openwall.com/lists/oss-security/2020/12/08/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.debian.org/security/2020/dsa-4820","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-29565","tags":["advisory"]},{"url":"https://github.com/openstack/horizon/commit/252467100f75587e18df9c43ed5802ee8f0017fa","tags":["web"]},{"url":"https://github.com/openstack/horizon/commit/6c208edf323ced07b15ec4bc3879bddb91d398bc","tags":["web"]},{"url":"https://github.com/openstack/horizon/commit/9e0e333ab5277b6c396f602862ff90398cb0242b","tags":["web"]},{"url":"https://github.com/openstack/horizon/commit/baa370f84332ad41502daea29a551705696f4421","tags":["web"]},{"url":"https://review.opendev.org/c/openstack/horizon/+/758841","tags":["web"]},{"url":"https://review.opendev.org/c/openstack/horizon/+/758843","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/horizon/PYSEC-2020-45.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-f8fh-xp28-q59m","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-29565","tags":["advisory"]},{"url":"https://github.com/openstack/horizon","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2020:5411","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1811510","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5411.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-29565","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-29565","tags":["advisory","report"]},{"url":"https://www.openwall.com/lists/oss-security/2020/12/08/2","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2020:5572","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5572.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210099-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1179955","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29565","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-29565","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4675-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-29565","description":"An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the \"next\" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL.","status":"published","published":"2020-12-04T07:06:03Z","modified":"2024-08-04T16:55:10.412Z","updated_at":"2026-11-02T14:35:55.460269Z"}],"euvd":[{"id":"EUVD-2020-0084","description":"An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the \"next\" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL.","status":"published","published":"2020-12-04T07:06:03Z","modified":"2024-08-04T16:55:10Z","updated_at":"2026-11-03T03:07:07.463834Z"}],"ghsa":[{"id":"GHSA-f8fh-xp28-q59m","title":"OpenStack Horizon Open redirect in workflow forms","description":"An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the \"next\" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL.","status":"published","published":"2022-05-24T17:35:25Z","modified":"2024-09-20T21:52:11Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:38:05.526697Z"}],"nvd":[{"id":"CVE-2020-29565","description":"An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the \"next\" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL.","status":"published","published":"2020-12-04T08:15:11.143Z","modified":"2026-06-17T03:11:26.443Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:06:27.10541Z"}],"osv":[{"id":"CVE-2020-29565","description":"An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the \"next\" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL.","status":"published","published":"2020-12-04T08:15:11.143Z","modified":"2026-10-24T10:30:21.150418188Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:16.612899Z"},{"id":"DEBIAN-CVE-2020-29565","description":"An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the \"next\" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL.","status":"published","published":"2020-12-04T08:15:11.143Z","modified":"2026-10-26T12:02:49.606697779Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:34.019707Z"},{"id":"GHSA-f8fh-xp28-q59m","title":"OpenStack Horizon Open redirect in workflow forms","description":"An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the \"next\" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL.","status":"published","published":"2022-05-24T17:35:25Z","modified":"2024-09-20T22:01:39.240867Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:46:46.006631Z"},{"id":"RHSA-2020:5411","title":"Red Hat Security Advisory: python-django-horizon security update","status":"published","published":"2024-09-13T15:41:33Z","modified":"2026-06-29T10:33:11Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RHSA-2020:5572","title":"Red Hat Security Advisory: python-django-horizon security update","status":"published","published":"2024-09-13T15:40:34Z","modified":"2026-06-29T10:33:19Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"UBUNTU-CVE-2020-29565","description":"An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the \"next\" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL.","status":"published","published":"2020-12-04T08:15:00Z","modified":"2026-02-04T03:55:39.086363Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:24.541803Z"},{"id":"DSA-4820-1","title":"horizon - security update","status":"published","published":"2020-12-27T00:00:00Z","modified":"2026-03-09T02:09:52.7955Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"PYSEC-2020-45","description":"An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the \"next\" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL.","status":"published","published":"2020-12-04T08:15:00Z","modified":"2026-06-10T17:01:51.264142559Z","updated_at":"2026-11-02T15:52:52.682031Z"},{"id":"SUSE-SU-2021:0099-1","title":"Security update for openstack-dashboard, release-notes-suse-openstack-cloud","description":"This update for openstack-dashboard, release-notes-suse-openstack-cloud fixes the following issues:\n\n- Fix open redirect (OSSA-2020-008, CVE-2020-29565)\n- Fix horizon-nodejs jobs.\n- Add workaround for secure boot issue when shim package is updated. (bsc#1179955)\n","status":"published","published":"2021-01-12T18:47:08Z","modified":"2025-05-02T04:10:15.116054Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"USN-4675-1","title":"horizon vulnerability","description":"Pritam Singh discovered that OpenStack Horizon incorrectly validated\ncertain parameters. An attacker could possibly use this issue to cause\nOpenStack Horizon to redirect to a malicious URL.\n","status":"published","published":"2021-01-05T13:20:31Z","modified":"2026-02-10T04:42:00Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}