CVE-2013-6858: XSS
First published: Sat Nov 23 2013(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in OpenStack Dashboard (Horizon) 2013.2 and earlier allow local users to inject arbitrary web script or HTML via an instance name to (1) "Volumes" or (2) "Network Topology" page.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OpenStack Horizon | >=2013.1<=2013.2 | |
| openSUSE | =13.1 | |
| Ubuntu Linux | =12.10 | |
| Ubuntu Linux | =13.04 | |
| Ubuntu Linux | =13.10 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2013-6858?
CVE-2013-6858 has a medium severity level due to its potential for cross-site scripting (XSS).
How do I fix CVE-2013-6858?
To fix CVE-2013-6858, update OpenStack Dashboard (Horizon) to a version later than 2013.2 that patches the XSS vulnerabilities.
What versions are affected by CVE-2013-6858?
CVE-2013-6858 affects OpenStack Dashboard (Horizon) versions 2013.2 and earlier as well as specific versions of openSUSE and Ubuntu Linux.
What are the implications of CVE-2013-6858?
The implications of CVE-2013-6858 include the risk of local users injecting malicious scripts that may lead to unauthorized actions within the application.
Who is impacted by CVE-2013-6858?
Any local user of OpenStack Dashboard (Horizon) 2013.2 or earlier on affected operating systems is potentially impacted by CVE-2013-6858.
- agent/references
- agent/type
- agent/weakness
- agent/remedy
- agent/severity
- agent/author
- agent/description
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/openstack
- canonical/openstack horizon
- version/openstack horizon/2013.1
- version/openstack horizon/2013.2
- vendor/opensuse
- canonical/opensuse
- version/opensuse/13.1
- vendor/canonical
- canonical/ubuntu linux
- version/ubuntu linux/12.10
- version/ubuntu linux/13.04
- version/ubuntu linux/13.10