[openstack-announce] [OSSA 2015-010] XSS in Horizon Heat stack creation (CVE-2015-3219)

Tristan Cacqueray tdecacqu at redhat.com
Tue Jun 9 20:38:05 UTC 2015

OSSA-2015-010: XSS in Horizon Heat stack creation

:Date: June 09, 2015
:CVE: CVE-2015-3219

- Horizon: 2014.2 versions through 2014.2.3 and version 2015.1.0

Nikita Konovalov from Mirantis reported a vulnerability in Horizon. By
tricking a Horizon user into using a malicious template in the
Orchestration/Stack section of Horizon, a remote attacker may trigger
a cross-site-scripting vulnerability during the stack creation. It may
result in potential assets theft like user access credentials. Only
setups exposing the orchestration dashboard in Horizon are affected.

- https://review.openstack.org/189821 (Juno)
- https://review.openstack.org/189822 (Kilo)
- https://review.openstack.org/189820 (Liberty)

- Nikita Konovalov from Mirantis (CVE-2015-3219)

- https://launchpad.net/bugs/1453074
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3219

- This fix will be included in future 2014.2.4 (juno) and 2015.1.1
  (kilo) releases.

Tristan Cacqueray
OpenStack Vulnerability Management Team

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 473 bytes
Desc: OpenPGP digital signature
URL: <http://lists.openstack.org/pipermail/openstack-announce/attachments/20150609/37c668f4/attachment.pgp>

More information about the OpenStack-announce mailing list