CVE-2014-3594

Name	CVE-2014-3594
Description	Cross-site scripting (XSS) vulnerability in the Host Aggregates interface in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-3 allows remote administrators to inject arbitrary web script or HTML via a new host aggregate name.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severity	low
Debian Bugs	758930

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
horizon (PTS)	jessie (security), jessie	2014.1.3-7+deb8u2	fixed
	stretch	3:10.0.1-1	fixed
	buster	3:14.0.2-3	fixed
	bullseye, sid	3:16.0.0-4	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
horizon	source	(unstable)	2014.1.2-3			758930
horizon	source	wheezy	(not affected)

[wheezy] - horizon <not-affected> (Vulnerable code not present)
up to 2013.2.3, and 2014.1 versions up to 2014.1.2