CVE-2014-3474: XSS
Cross-site scripting (XSS) vulnerability in horizon/static/horizon/js/horizon.instances.js in the Launch Instance menu in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to inject arbitrary web script or HTML via a network name.
Other sources
Cross-site scripting (XSS) vulnerability in horizon/static/horizon/js/horizon.instances.js in the Launch Instance menu in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to inject arbitrary web script or HTML via a network name.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3474?
CVE-2014-3474 is classified as a medium severity vulnerability due to its potential impact on application security via XSS attacks.
How do I fix CVE-2014-3474?
To fix CVE-2014-3474, upgrade OpenStack Horizon to version 2013.2.4 or later, 2014.1.2 or later, or Juno-2 or later.
Who is affected by CVE-2014-3474?
CVE-2014-3474 affects OpenStack Horizon versions prior to 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2.
What kind of attack can exploit CVE-2014-3474?
CVE-2014-3474 can be exploited for cross-site scripting (XSS) attacks, allowing attackers to inject arbitrary web scripts or HTML.
Is there a patch available for CVE-2014-3474?
Yes, patches for CVE-2014-3474 are included in the recommended version upgrades for the affected OpenStack Horizon releases.