{
  "threat_severity" : "Important",
  "public_date" : "2016-06-17T00:00:00Z",
  "bugzilla" : {
    "description" : "python-django-horizon: XSS in client side template",
    "id" : "1343982",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1343982"
  },
  "cvss" : {
    "cvss_base_score" : "4.9",
    "cvss_scoring_vector" : "AV:N/AC:M/Au:S/C:P/I:P/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-79",
  "details" : [ "Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.", "A DOM-based, cross-site scripting vulnerability has been identified in the OpenStack dashboard, where user input was not filtered correctly. An authenticated dashboard user could exploit the flaw by injecting an AngularJS template into a dashboard form (for example, using an image's description), triggering the vulnerability when another user browsed the affected page. As a result, this flaw could result in user accounts being compromised (for example, user-access credentials being stolen)." ],
  "acknowledgement" : "Red Hat would like to thank the OpenStack project for reporting this issue. Upstream acknowledges Beth Lancaster (Virginia Tech) and Brandon Sawyers (Virginia Tech) as the original reporters.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6",
    "release_date" : "2016-06-21T00:00:00Z",
    "advisory" : "RHSA-2016:1268",
    "cpe" : "cpe:/a:redhat:openstack:5::el6",
    "package" : "python-django-horizon-0:2014.1.5-4.el6ost"
  }, {
    "product_name" : "Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7",
    "release_date" : "2016-06-21T00:00:00Z",
    "advisory" : "RHSA-2016:1269",
    "cpe" : "cpe:/a:redhat:openstack:5::el7",
    "package" : "python-django-horizon-0:2014.1.5-4.el7ost"
  }, {
    "product_name" : "Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7",
    "release_date" : "2016-06-21T00:00:00Z",
    "advisory" : "RHSA-2016:1271",
    "cpe" : "cpe:/a:redhat:openstack:6::el7",
    "package" : "python-django-horizon-0:2014.2.3-9.el7ost"
  }, {
    "product_name" : "Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7",
    "release_date" : "2016-06-21T00:00:00Z",
    "advisory" : "RHSA-2016:1272",
    "cpe" : "cpe:/a:redhat:openstack:7::el7",
    "package" : "python-django-horizon-0:2015.1.4-1.el7ost"
  }, {
    "product_name" : "Red Hat OpenStack Platform 8.0 (Liberty)",
    "release_date" : "2016-06-21T00:00:00Z",
    "advisory" : "RHSA-2016:1270",
    "cpe" : "cpe:/a:redhat:openstack:8::el7",
    "package" : "python-django-horizon-1:8.0.1-4.el7ost"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat OpenStack Platform 10 (Newton)",
    "fix_state" : "Not affected",
    "package_name" : "python-django-horizon",
    "cpe" : "cpe:/a:redhat:openstack:10"
  }, {
    "product_name" : "Red Hat OpenStack Platform 9 (Mitaka)",
    "fix_state" : "Not affected",
    "package_name" : "python-django-horizon",
    "cpe" : "cpe:/a:redhat:openstack:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2016-4428\nhttps://nvd.nist.gov/vuln/detail/CVE-2016-4428" ],
  "name" : "CVE-2016-4428",
  "csaw" : false
}