QwikSec

Security Database

CVE

CWE

Training

CVE-2015-3219

Published: Aug 20, 2015

Modified: Aug 6, 2024

PUBLISHED

Description

Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the description parameter in a heat template, which is not properly handled in the help_text attribute in the Field class.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

[openstack-announce] 20150609 [OSSA 2015-010] XSS in Horizon Heat stack creation (CVE-2015-3219)

mailing-list

x_refsource_MLIST

https://bugs.launchpad.net/horizon/+bug/1453074

x_refsource_CONFIRM

vdb-entry

x_refsource_BID

vendor-advisory

x_refsource_DEBIAN

http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html

x_refsource_CONFIRM

vendor-advisory

x_refsource_REDHAT

[oss-security] 20150609 [OSSA 2015-010] XSS in Horizon Heat stack creation (CVE-2015-3219)

mailing-list

x_refsource_MLIST

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.