OpenStack Horizon Cross-site scripting (XSS) vulnerability
Date: 2022-05
Affected: pip/horizon
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2012-2094
CWE: CWE-79

Cross-site scripting (XSS) vulnerability in the refresh mechanism in the log viewer in `horizon/static/horizon/js/horizon.js` in OpenStack Dashboard (Horizon) folsom-1 and 2012.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the guest console.


Mitigations:

Architectural layers (MAESTRO):