Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3447-1 advisory.

    Beth Lancaster and Brandon Sawyers discovered that OpenStack Horizon was incorrect protected against     cross-site scripting (XSS) attacks. A remote authenticated user could use this issue to inject web script     or HTML in a dashboard form.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security fix for CVE-2016-4428, rebase to 2015.1.4

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Two cross-site scripting vulnerabilities have been found in Horizon, a web application to control an OpenStack cloud.

It was discovered that there was an XSS vulnerability in horizon, a Django module providing web interaction with OpenStack.

For Debian 7 'Wheezy', this issue has been fixed in horizon version 2012.1.1-10+deb7u1.

We recommend that you upgrade your horizon packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
103810	Ubuntu 14.04 LTS : OpenStack Horizon vulnerability (USN-3447-1)	Nessus	Ubuntu Local Security Checks	medium
92296	Fedora 23 : python-django-horizon (2016-e538b11379)	Nessus	Fedora Local Security Checks	medium
91965	Debian DSA-3617-1 : horizon - security update	Nessus	Debian Local Security Checks	medium
91690	Debian DLA-520-1 : horizon security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2016-4428

medium

Tenable Plugins

medium

medium

medium

medium