CVE-2014-8578: Cross-site scripting (XSS) vulnerability in the Groups panel in OpenStack Dashboard (Horizon) before 2013.2...

Security readout for executives and security teams

CVE-2014-8578 is a stored cross-site scripting issue in OpenStack Horizon’s Groups panel. An authenticated remote administrator could place script or HTML in a user email address that Horizon later renders. The main business concern is compromise of dashboard sessions or misleading content inside a cloud administration interface. Exposure is likely limited to organizations still running the affected Horizon release lines or downstream packages derived from them. The attacker role is described as remote administrator, so unauthenticated public exploitation is not supported by the provided sources. Prioritize remediation for internet-reachable or broadly accessible Horizon dashboards. For tightly restricted, modern deployments, urgency is lower, but cloud administration interfaces should not retain known XSS flaws. Mitigation focus: Upgrade Horizon beyond the affected versions listed in the CVE.; Check OpenStack or distribution vendor advisories for exact fixed packages.; Restrict Horizon administrative access to trusted users and networks..

Prepared

Jun 14, 2026, 06:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.