CVE-2014-3473

CVSS V2 Medium 4.3 CVSS V3 None
Description
Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when used with Heat, allows remote Orchestration template owners or catalogs to inject arbitrary web script or HTML via a crafted template.
Overview
  • CVE ID
  • CVE-2014-3473
  • Assigner
  • secalert@redhat.com
  • Vulnerability Status
  • Modified
  • Published Version
  • 2014-10-31T15:55:03
  • Last Modified Date
  • 2023-02-13T00:39:14
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:openstack:horizon:*:*:*:*:*:*:*:* 1 OR 2013.2 2013.2.4
cpe:2.3:a:openstack:horizon:*:*:*:*:*:*:*:* 1 OR 2014.1 2014.1.2
cpe:2.3:a:openstack:horizon:juno-1:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:* 1 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:M/Au:N/C:N/I:P/A:N
  • Access Vector
  • NETWORK
  • Access Compatibility
  • MEDIUM
  • Authentication
  • NONE
  • Confidentiality Impact
  • NONE
  • Integrity Impact
  • PARTIAL
  • Availability Impact
  • NONE
  • Base Score
  • 4.3
  • Severity
  • MEDIUM
  • Exploitability Score
  • 8.6
  • Impact Score
  • 2.9
History
Created Old Value New Value Data Type Notes
2022-05-10 07:20:39 Added to TrackCVE
2022-12-02 02:08:08 2014-10-31T15:55Z 2014-10-31T15:55:03 CVE Published Date updated
2022-12-02 02:08:08 2021-03-09T14:52:06 CVE Modified Date updated
2022-12-02 02:08:08 Analyzed Vulnerability Status updated
2023-02-02 16:04:49 2023-02-02T15:16:24 CVE Modified Date updated
2023-02-02 16:04:49 Analyzed Modified Vulnerability Status updated
2023-02-02 16:04:49 Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when used with Heat, allows remote Orchestration template owners or catalogs to inject arbitrary web script or HTML via a crafted template. CVE-2014-3473 CVE-2014-3474 CVE-2014-3475 CVE-2014-8578 openstack-horizon: multiple XSS flaws Description updated
2023-02-02 16:04:50 References updated
2023-02-13 01:05:19 2023-02-13T00:39:14 CVE Modified Date updated
2023-02-13 01:05:19 CVE-2014-3473 CVE-2014-3474 CVE-2014-3475 CVE-2014-8578 openstack-horizon: multiple XSS flaws Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in the Horizon Orchestration dashboard in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2, when used with Heat, allows remote Orchestration template owners or catalogs to inject arbitrary web script or HTML via a crafted template. Description updated