CVSS 3.1
5.4 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NCVE-2016-4428
Medium (5.4). EPSS 2.1% chance of exploitation in the next 30 days. Fixed in horizon 8.0.2, 9.1.0.
Cross-site scripting (XSS) vulnerability in OpenStack Dashboard (Horizon) 8.0.1 and earlier and 9.0.0 through 9.0.1 allows remote authenticated users to inject arbitrary web script or HTML by injecting an AngularJS template in a dashboard form.
Severity
- EPSS
- 2.1% chance of exploitation in the next 30 days; higher than 81% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- openstack:horizon
- redhat:openstack
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-grm6-x6mr-q3cv | PyPI | horizon | <8.0.2 | 8.0.2 |
| GHSA-grm6-x6mr-q3cv | PyPI | horizon | >=9.0.0 <9.1.0 | 9.1.0 |
| PYSEC-2026-643 | PyPI | horizon | <8.0.2 >=9.0.0 <9.1.0 | 8.0.2, 9.1.0 |