CVE-2014-0157 OpenStack Dashboard (aka Horizon) vulnerable to Cross-site Scripting

What is CVE-2014-0157?

CVE-2014-0157 is a medium-severity cross-site scripting vulnerability in Opensuse Opensuse, published on 15 Apr 2014. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Cross-site scripting (XSS) vulnerability in the Horizon Orchestration dashboard in OpenStack Dashboard (aka Horizon) 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to inject arbitrary web script or HTML via the description field of a Heat template.

Weakness: CWE-79

Which versions are affected by CVE-2014-0157?

3 open source packages ship an affected version, including horizon. It affects 2 products.

Products include Openstack Horizon, Opensuse Opensuse.

How do I fix CVE-2014-0157?

Upgrade horizon to 2013.2.4 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2014-0157 being exploited?

There is no known exploitation of CVE-2014-0157 in the wild and no public exploit code.

Other vulnerabilities in Opensuse Opensuse

• CVE-2012-2144 OpenStack Horizon Session Fixation Medium 6.8
• CVE-2022-45582 Horizon Web Dashboard Open Redirect vulnerability Medium 6.1
• CVE-2026-55748 OpenStack Horizon RC file generation does not escape special characters in project names Medium 6.0
• CVE-2012-3540 Open redirect in n/a Medium 5.8
• CVE-2013-4471 Auth bypass in n/a Medium 5.5

All Opensuse Opensuse vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2014-0157, GHSA-cmg8-5c63-pg95, PYSEC-2026-822, RHSA-2014:0581.