Description
Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | horizon | 3:9.0.1-2 | — |
| Debian 13 | horizon | 3:9.0.1-2 | — |
| Debian 12 | horizon | 3:9.0.1-2 | — |
| Debian 8 | horizon | 2014.1.3-7+deb8u2 | DSA-3617-1 |
| Debian 7 | horizon | 2012.1.1-10+deb7u1 | DLA-520-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | horizon | 1:2014.1.5-0ubuntu2.1 | USN-3447-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 8 | openstack-dashboard +2 | 1:8.0.1-4.el7ost | RHSA-2016:1270 |
| Red Hat OpenStack 7 | openstack-dashboard +3 | 2015.1.4-1.el7ost | RHSA-2016:1272 |
| Red Hat OpenStack 6 | openstack-dashboard +3 | 2014.2.3-9.el7ost | RHSA-2016:1271 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 5 | openstack-dashboard +3 | 2014.1.5-4.el6ost | RHSA-2016:1269, RHSA-2016:1268 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud 6 | openstack-ceilometer | 5.0.4~a0~dev6-6.1 | SUSE-SU-2016:2143-1 |
| SUSE OpenStack Cloud 6 | openstack-ceilometer-doc | 5.0.4~a0~dev6-6.2 | SUSE-SU-2016:2143-1 |
| SUSE OpenStack Cloud 6 | openstack-cinder +1 | 7.0.3~a0~dev2-7.1 | SUSE-SU-2016:2143-1 |
| SUSE OpenStack Cloud 6 | openstack-dashboard | 8.0.2~a0~dev34-8.1 | SUSE-SU-2016:2143-1 |
| SUSE OpenStack Cloud 6 | openstack-glance +1 | 11.0.2~a0~dev13-7.1 | SUSE-SU-2016:2143-1 |
| SUSE OpenStack Cloud 6 | openstack-heat | 5.0.2~a0~dev93-9.1 | SUSE-SU-2016:2143-1 |
| SUSE OpenStack Cloud 6 | openstack-heat-doc | 5.0.2~a0~dev93-9.3 | SUSE-SU-2016:2143-1 |
| SUSE OpenStack Cloud 6 | openstack-keystone | 8.1.1~a0~dev13-3.1 | SUSE-SU-2016:2143-1 |
| SUSE OpenStack Cloud 6 | openstack-keystone-doc | 8.1.1~a0~dev13-3.2 | SUSE-SU-2016:2143-1 |
| SUSE OpenStack Cloud 6 | openstack-manila | 1.0.2~a0~dev11-9.1 | SUSE-SU-2016:2143-1 |
| SUSE OpenStack Cloud 6 | openstack-manila-doc | 1.0.2~a0~dev11-9.2 | SUSE-SU-2016:2143-1 |
| SUSE OpenStack Cloud 6 | openstack-neutron +1 | 7.1.2~a0~dev29-10.1 | SUSE-SU-2016:2143-1 |
| SUSE OpenStack Cloud 6 | openstack-neutron-fwaas +3 | 7.1.2~a0~dev1-6.1 | SUSE-SU-2016:2143-1 |
| SUSE OpenStack Cloud 6 | openstack-nova +1 | 12.0.5~a0~dev2-7.1 | SUSE-SU-2016:2143-1 |
| SUSE OpenStack Cloud 6 | openstack-resource-agents | 1.0+git.1467079370.4f2c49d-7.1 | SUSE-SU-2016:2143-1 |
| SUSE OpenStack Cloud 6 | python-networking-cisco | 2.1.1-6.1 | SUSE-SU-2016:2143-1 |
| SUSE OpenStack Cloud 6 | python-openstackclient | 1.7.2-4.1 | SUSE-SU-2016:2143-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | horizon | < 8.0.2 | 8.0.2 | GHSA-grm6-x6mr-q3cv |
| PyPI | horizon | >= 9.0.0, < 9.1.0 | 9.1.0 | GHSA-grm6-x6mr-q3cv |
| PyPI | horizon | < 8.0.2 · >= 9.0.0, < 9.1.0 | 8.0.2, 9.1.0 | PYSEC-2026-643 |
Advisories 9
- RHSA-2016:1272 Red Hat Security Advisory: python-django-horizon security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2016:1270 Red Hat Security Advisory: python-django-horizon security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2016:1271 Red Hat Security Advisory: python-django-horizon security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2016:1268 Red Hat Security Advisory: python-django-horizon security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2016:1269 Red Hat Security Advisory: python-django-horizon security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DLA-520-1 horizon - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3617-1 horizon - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-3447-1 horizon vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- SUSE-SU-2016:2143-1 Security update for several openstack-components SUSE / openSUSE Security Updates · Feb 4, 2026
References
- RHSA-2016:1268 vendor-advisory
- RHSA-2016:1270 vendor-advisory
- DSA-3617 vendor-advisory
- RHSA-2016:1272 vendor-advisory
- https://security.openstack.org/ossa/OSSA-2016-010.html
- https://review.openstack.org/329997
- https://bugs.launchpad.net/horizon/+bug/1567673
- RHSA-2016:1269 vendor-advisory
- [oss-security] 20160617 [OSSA-2016-010] XSS in Horizon client side template (CVE-2016-4428) mailing-list
- RHSA-2016:1271 vendor-advisory
- https://review.openstack.org/329998
- https://review.openstack.org/329996