VYPR
Get started
← All advisories
Moderate severityNVD Advisory· Published Jun 5, 2012· Updated Apr 29, 2026

CVE-2012-2094

CVE-2012-2094

Description

Cross-site scripting (XSS) vulnerability in the refresh mechanism in the log viewer in horizon/static/horizon/js/horizon.js in OpenStack Dashboard (Horizon) folsom-1 and 2012.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the guest console.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
horizonPyPI
< 8.0.0a08.0.0a0

Affected products

2
  • OpenStack/Horizon2 versions
    cpe:2.3:a:openstack:horizon:2012.1:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:openstack:horizon:2012.1:*:*:*:*:*:*:*
    • cpe:2.3:a:openstack:horizon:folsom-1:*:*:*:*:*:*:*

Patches

2
ab2e27522aae

html escape the console log in refresh

https://github.com/openstack/horizonJ. Daniel SchmidtApr 10, 2012via ghsa
commit
1 file changed · +1 −1
  • horizon/static/horizon/js/horizon.js+1 −1 modified
    @@ -284,7 +284,7 @@ var Horizon = function() {
         data: data,
         method: 'get',
         success: function(response_body) {
-          $('pre.logs').html(response_body);
+          $('pre.logs').text(response_body);
         },
         error: function(response) {
           if(via_user_submit) {
7f8c788aa70d

html escape the console log in refresh

https://github.com/openstack/horizonJ. Daniel SchmidtApr 10, 2012via ghsa
commit
1 file changed · +1 −1
  • horizon/static/horizon/js/horizon.js+1 −1 modified
    @@ -284,7 +284,7 @@ var Horizon = function() {
         data: data,
         method: 'get',
         success: function(response_body) {
-          $('pre.logs').html(response_body);
+          $('pre.logs').text(response_body);
         },
         error: function(response) {
           if(via_user_submit) {

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

13

News mentions

0

No linked articles in our index yet.