CVE-2015-3988: XSS
Published May 19, 2015
·Updated
Multiple cross-site scripting (XSS) vulnerabilities in OpenStack Dashboard (Horizon) 2015.1.0 allow remote authenticated users to inject arbitrary web script or HTML via the metadata to a (1) Glance image, (2) Nova flavor or (3) Host Aggregate.
Affected Software
2 affected components
Openstack Horizon=2015.1.0
Oracle Solaris=11.2
Event History
May 19, 2015
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-3988?
CVE-2015-3988 is considered to have a medium severity due to the potential for cross-site scripting attacks.
2
How do I fix CVE-2015-3988?
The recommended fix for CVE-2015-3988 is to update OpenStack Horizon to a version that addresses the XSS vulnerabilities.
3
What is affected by CVE-2015-3988?
CVE-2015-3988 affects OpenStack Dashboard (Horizon) version 2015.1.0.
4
Can CVE-2015-3988 be exploited by unauthenticated users?
No, CVE-2015-3988 can only be exploited by remote authenticated users.
5
What types of data can be compromised by CVE-2015-3988?
CVE-2015-3988 allows the injection of arbitrary web scripts or HTML into Glance images, Nova flavors, or Host Aggregates.