MEDIUM5.4
PYSEC-2026-643
OpenStack Dashboard (Horizon) Cross-site scripting (XSS) vulnerability
Quick fix
PYSEC-2026-643 — horizon: upgrade to the fixed version with the command below.
pip install --upgrade 'horizon>=8.0.2'Details
Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://nvd.nist.gov/vuln/detail/CVE-2016-4428[ADVISORY]
- https://github.com/openstack/horizon/commit/62b4e6f30a7ae7961805abdffdb3c7ae5c2b676a[WEB]
- https://github.com/openstack/horizon/commit/d585e5eb9acf92d10d39b6c2038917a7e8ac71bb[WEB]
- https://github.com/openstack/horizon/commit/fc8d70560401f3985e5672a4c580f10d51e985a4[WEB]
- https://access.redhat.com/errata/RHSA-2016:1268[WEB]
- https://access.redhat.com/errata/RHSA-2016:1269[WEB]
- https://access.redhat.com/errata/RHSA-2016:1270[WEB]
- https://access.redhat.com/errata/RHSA-2016:1271[WEB]
- https://access.redhat.com/errata/RHSA-2016:1272[WEB]
- https://access.redhat.com/security/cve/CVE-2016-4428[WEB]
- https://bugs.launchpad.net/horizon/+bug/1567673[WEB]
- https://bugzilla.redhat.com/show_bug.cgi?id=1343982[WEB]
- https://review.openstack.org/329996[WEB]
- https://review.openstack.org/329997[WEB]
- https://review.openstack.org/329998[WEB]
- https://security.openstack.org/ossa/OSSA-2016-010.html[WEB]
- http://www.debian.org/security/2016/dsa-3617[WEB]
- http://www.openwall.com/lists/oss-security/2016/06/17/4[WEB]
- https://pypi.org/project/horizon[PACKAGE]
- https://github.com/advisories/GHSA-grm6-x6mr-q3cv[ADVISORY]