CVE-2013-6858: Multiple cross-site scripting (XSS) vulnerabilities in OpenStack Dashboard (Horizon) 2013.2 and earlier all...

Security readout for executives and security teams

CVE-2013-6858 is an XSS issue in OpenStack Dashboard (Horizon) 2013.2 and earlier. A local user could place script or HTML in an instance name that appears on the Volumes or Network Topology pages. The bundle does not provide CVSS, a named fixed version, or evidence of active exploitation. Exposure is most likely in legacy OpenStack Horizon deployments at version 2013.2 or earlier, especially environments where local users can control instance names and privileged operators use the affected dashboard views. Treat this as a legacy cloud management exposure. It is not flagged as actively exploited in the supplied sources, but vulnerable dashboards may expose privileged operator sessions if untrusted tenants can influence displayed names. Mitigation focus: Identify any Horizon deployments at version 2013.2 or earlier.; Review Ubuntu, openSUSE, or upstream Horizon guidance for the applicable fixed package.; Apply vendor-supported updates rather than ad hoc template changes..

Prepared

Jun 14, 2026, 15:13 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.