NVD Vulnerability Detail

CVE-2014-3474

Summary	Cross-site scripting (XSS) vulnerability in horizon/static/horizon/js/horizon.instances.js in the Launch Instance menu in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to inject arbitrary web script or HTML via a network name.
Publication Date	Nov. 1, 2014, 12:55 a.m.
Registration Date	Jan. 26, 2021, 3:10 p.m.
Last Update	Nov. 21, 2024, 11:08 a.m.

Affected software configurations

Configuration2		or higher	or less	more than	less than
cpe:2.3:o:opensuse:opensuse:13.1:::::::*

Related information, measures and tools

No	URL	タグ
1	http://lists.opensuse.org/opensuse-updates/2015-01/msg00040.html	Mailing List Third Party Advisory
2	http://lists.opensuse.org/opensuse-updates/2015-01/msg00040.html	Mailing List Third Party Advisory
3	http://www.openwall.com/lists/oss-security/2014/07/08/6	Mailing List Patch
4	http://www.openwall.com/lists/oss-security/2014/07/08/6	Mailing List Patch
5	http://www.securityfocus.com/bid/68460	Third Party Advisory VDB Entry
6	http://www.securityfocus.com/bid/68460	Third Party Advisory VDB Entry
7	https://bugs.launchpad.net/horizon/+bug/1322197	Exploit Issue Tracking Third Party Advisory
8	https://bugs.launchpad.net/horizon/+bug/1322197	Exploit Issue Tracking Third Party Advisory
9	https://review.openstack.org/#/c/105477	Patch Vendor Advisory
10	https://review.openstack.org/#/c/105477	Patch Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-79	クロスサイト・スクリプティング（XSS）	https://cwe.mitre.org/data/definitions/79.html

JVN Vulnerability Information

OpenStack Dashboard の Launch Instance メニューの horizon/static/horizon/js/horizon.instances.js におけるクロスサイトスクリプティングの脆弱性

Title	OpenStack Dashboard の Launch Instance メニューの horizon/static/horizon/js/horizon.instances.js におけるクロスサイトスクリプティングの脆弱性
Summary	OpenStack Dashboard (Horizon) の Launch Instance メニューの horizon/static/horizon/js/horizon.instances.js には、クロスサイトスクリプティングの脆弱性が存在します。
Possible impacts	リモート認証されたユーザにより、ネットワーク名を介して、任意の Web スクリプトまたは HTML を挿入される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	July 23, 2014, midnight
Registration Date	Nov. 4, 2014, 6:52 p.m.
Last Update	Dec. 4, 2014, 6:12 p.m.

Affected System

OpenStack

OpenStack Horizon 2013.2.4 未満

OpenStack Horizon 2014.1.2 未満の 2014.1

OpenStack Horizon Juno-2 未満の Juno

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2014-3474	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3474
National Vulnerability Database (NVD)
2	CVE-2014-3474	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3474

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-79	https://jvndb.jvn.jp/ja/cwe/CWE-79.html

ベンダー情報

No	Name	URL
Code Review
1	Change Ic8a92e69: Fix multiple Cross-Site Scripting (XSS) vulnerabilities.	https://review.openstack.org/#/c/105477
Launchpad
2	Bug #1322197	https://bugs.launchpad.net/horizon/+bug/1322197
SECURITY BLOG
3	Multiple cross-site scripting (XSS) vulnerabilities in OpenStack Horizon	https://blogs.oracle.com/sunsecurity/entry/multiple_cross_site_scripting_xss1

その他

No	Name	URL
関連文書
1	[OSSA 2014-023] Multiple XSS vulnerabilities in Horizon (CVE-2014-3473, CVE-2014-3474, and CVE-2014-3475)	http://www.openwall.com/lists/oss-security/2014/07/08/6

Change Log

No	Changed Details	Date of change
0	[2014年11月04日] 掲載 [2014年12月04日] ベンダ情報：オラクル (Multiple cross-site scripting (XSS) vulnerabilities in OpenStack Horizon) を追加	Feb. 17, 2018, 10:37 a.m.