Vulnerability Details : CVE-2014-8578
Cross-site scripting (XSS) vulnerability in the Groups panel in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-3475.
Vulnerability category: Cross site scripting (XSS)
Exploit prediction scoring system (EPSS) score for CVE-2014-8578
Probability of exploitation activity in the next 30 days: 0.12%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 45 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2014-8578
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
3.5
|
LOW | AV:N/AC:M/Au:S/C:N/I:P/A:N |
6.8
|
2.9
|
NIST |
CWE ids for CVE-2014-8578
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-8578
-
https://bugs.launchpad.net/horizon/+bug/1320235
Bug #1320235 “[OSSA 2014-023] Stored XSS for /admin/users/ (CVE-...” : Bugs : OpenStack Dashboard (Horizon)Issue Tracking;Third Party Advisory
-
http://www.securityfocus.com/bid/68456
OpenStack Horizon Users Email Address CVE-2014-3475 HTML Injection VulnerabilityThird Party Advisory;VDB Entry
-
http://www.openwall.com/lists/oss-security/2014/07/08/6
oss-security - [OSSA 2014-023] Multiple XSS vulnerabilities in Horizon (CVE-2014-3473, CVE-2014-3474, and CVE-2014-3475)Mailing List;Patch
Products affected by CVE-2014-8578
- cpe:2.3:a:openstack:horizon:*:*:*:*:*:*:*:*
- cpe:2.3:a:openstack:horizon:*:*:*:*:*:*:*:*
- cpe:2.3:a:openstack:horizon:*:*:*:*:*:*:*:*
- cpe:2.3:a:openstack:horizon:juno-1:*:*:*:*:*:*:*