CVE-2016-4428

Name	CVE-2016-4428
Description	Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
References	DLA-520-1, DSA-3617-1
NVD severity	low
Debian Bugs	828967

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
horizon (PTS)	jessie (security), jessie	2014.1.3-7+deb8u2	fixed
	stretch	3:10.0.1-1	fixed
	buster	3:14.0.2-3	fixed
	bullseye, sid	3:18.3.2-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
horizon	source	(unstable)	3:9.0.1-2		828967
horizon	source	jessie	2014.1.3-7+deb8u2	DSA-3617-1
horizon	source	wheezy	2012.1.1-10+deb7u1	DLA-520-1

https://bugs.launchpad.net/bugs/1567673