VYPR
Get started
← All advisories
Low severityNVD Advisory· Published Aug 22, 2014· Updated May 6, 2026

CVE-2014-3594

CVE-2014-3594

Description

Cross-site scripting (XSS) vulnerability in the Host Aggregates interface in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-3 allows remote administrators to inject arbitrary web script or HTML via a new host aggregate name.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
horizonPyPI
< 8.0.0a08.0.0a0

Affected products

4
  • OpenStack/Horizon3 versions
    cpe:2.3:a:openstack:horizon:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:openstack:horizon:*:*:*:*:*:*:*:*range: >=2013.2,<2013.2.4
    • cpe:2.3:a:openstack:horizon:juno-1:*:*:*:*:*:*:*
    • cpe:2.3:a:openstack:horizon:juno-2:*:*:*:*:*:*:*
  • OpenSUSE/openSUSE
    cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*

Patches

2
ba908ae88d59

Fix XSS issue with the unordered_list filter

https://github.com/openstack/horizonJulie PichonJul 29, 2014via ghsa
commit
1 file changed · +7 −3
  • openstack_dashboard/dashboards/admin/aggregates/tables.py+7 −3 modified
    @@ -93,18 +93,22 @@ def get_zone_hosts(zone):
     return host_details
 
 
+def safe_unordered_list(value):
+    return filters.unordered_list(value, autoescape=True)
+
+
 class HostAggregatesTable(tables.DataTable):
     name = tables.Column('name', verbose_name=_('Name'))
     availability_zone = tables.Column('availability_zone',
                                       verbose_name=_('Availability Zone'))
     hosts = tables.Column(get_aggregate_hosts,
                           verbose_name=_("Hosts"),
                           wrap_list=True,
-                          filters=(filters.unordered_list,))
+                          filters=(safe_unordered_list,))
     metadata = tables.Column(get_metadata,
                              verbose_name=_("Metadata"),
                              wrap_list=True,
-                             filters=(filters.unordered_list,))
+                             filters=(safe_unordered_list,))
 
     class Meta:
         name = "host_aggregates"
@@ -123,7 +127,7 @@ class AvailabilityZonesTable(tables.DataTable):
     hosts = tables.Column(get_zone_hosts,
                           verbose_name=_('Hosts'),
                           wrap_list=True,
-                          filters=(filters.unordered_list,))
+                          filters=(safe_unordered_list,))
     available = tables.Column(get_available,
                               verbose_name=_('Available'),
                               status=True,
ba2c98aea0db

Fix XSS issue with the unordered_list filter

https://github.com/openstack/horizonJulie PichonJul 29, 2014via ghsa
commit
1 file changed · +7 −3
  • openstack_dashboard/dashboards/admin/aggregates/tables.py+7 −3 modified
    @@ -98,18 +98,22 @@ def get_zone_hosts(zone):
     return host_details
 
 
+def safe_unordered_list(value):
+    return filters.unordered_list(value, autoescape=True)
+
+
 class HostAggregatesTable(tables.DataTable):
     name = tables.Column('name', verbose_name=_('Name'))
     availability_zone = tables.Column('availability_zone',
                                       verbose_name=_('Availability Zone'))
     hosts = tables.Column(get_aggregate_hosts,
                           verbose_name=_("Hosts"),
                           wrap_list=True,
-                          filters=(filters.unordered_list,))
+                          filters=(safe_unordered_list,))
     metadata = tables.Column(get_metadata,
                              verbose_name=_("Metadata"),
                              wrap_list=True,
-                             filters=(filters.unordered_list,))
+                             filters=(safe_unordered_list,))
 
     class Meta:
         name = "host_aggregates"
@@ -128,7 +132,7 @@ class AvailabilityZonesTable(tables.DataTable):
     hosts = tables.Column(get_zone_hosts,
                           verbose_name=_('Hosts'),
                           wrap_list=True,
-                          filters=(filters.unordered_list,))
+                          filters=(safe_unordered_list,))
     available = tables.Column(get_available,
                               verbose_name=_('Available'),
                               status=True,

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

20

News mentions

0

No linked articles in our index yet.