CVE-2015-3219

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the description parameter in a heat template, which is not properly handled in the help_text attribute in the Field class.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.openstack.org/pipermail/openstack-announce/2015-June/000361.htmlPatch, Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-1679.html
http://www.debian.org/security/2016/dsa-3617Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/06/09/7Patch
http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.htmlThird Party Advisory
http://www.securityfocus.com/bid/75109Third Party Advisory
https://bugs.launchpad.net/horizon/+bug/1453074Exploit, Vendor Advisory
http://lists.openstack.org/pipermail/openstack-announce/2015-June/000361.htmlPatch, Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-1679.html
http://www.debian.org/security/2016/dsa-3617Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/06/09/7Patch
http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.htmlThird Party Advisory
http://www.securityfocus.com/bid/75109Third Party Advisory
https://bugs.launchpad.net/horizon/+bug/1453074Exploit, Vendor Advisory

Timeline

Published: Aug 20, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-32207.5The tlslite library before 0.4.9 for Python allows remote attackers to trigger a denial of service (runtime exception and process crash).CVE-2015-32214.0OpenStack Neutron before 2014.2.4 (juno) and 2015.1.x before 2015.1.1 (kilo), when using the IPTables firewall driver, allows remote authent CVE-2015-32227.0syscheck/seechanges.c in OSSEC 2.7 through 2.8.1 on NIX systems allows local users to execute arbitrary code as root.CVE-2015-32235.3The ldb_wildcard_compare function in ldb_match.c in ldb before 1.1.24, as used in the AD LDAP server in Samba 4.x before 4.1.22, 4.2.x befor CVE-2015-32244.3request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For header CVE-2015-32255.0lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote atta CVE-2015-32264.3Cross-site scripting (XSS) vulnerability in json/encoding.rb in Active Support in Ruby on Rails 3.x and 4.1.x before 4.1.11 and 4.2.x before CVE-2015-32275.0The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is e CVE-2015-32286.8Integer overflow in the gs_heap_alloc_bytes function in base/gsmalloc.c in Ghostscript 9.15 and earlier allows remote attackers to cause a d CVE-2015-32295.9fedora-cloud-atomic.ks in spin-kickstarts allows remote attackers to conduct man-in-the-middle attacks by leveraging use of HTTP to download CVE-2015-32307.5389 Directory Server (formerly Fedora Directory Server) before 1.3.3.12 does not enforce the nsSSL3Ciphers preference when creating an sslSo CVE-2015-32314.0The Render cache system in Drupal 7.x before 7.38, when used to cache content by user role, allows remote authenticated users to obtain priv