CVE-2016-4428

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-07-12 · updated 2026-06-17
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.

Affected products

Debian Linux: 8.0, 9.0
OpenStack Horizon: from 8.0.0 through 8.0.1; 9.0.0, 9.0.1
OpenStack: 6.0, 7.0, 8, 5.0

References

http://www.debian.org/security/2016/dsa-3617
http://www.openwall.com/lists/oss-security/2016/06/17/4
https://access.redhat.com/errata/RHSA-2016:1268
https://access.redhat.com/errata/RHSA-2016:1269
https://access.redhat.com/errata/RHSA-2016:1270
https://access.redhat.com/errata/RHSA-2016:1271
https://access.redhat.com/errata/RHSA-2016:1272
https://bugs.launchpad.net/horizon/+bug/1567673
https://review.openstack.org/329996
https://review.openstack.org/329997
https://review.openstack.org/329998
https://security.openstack.org/ossa/OSSA-2016-010.html

Get alerted when CVE-2016-4428 or the next vulnerability affects your stack