CVE-2014-8578

Name	CVE-2014-8578
Description	Cross-site scripting (XSS) vulnerability in the Groups panel in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 allows remote administrators to inject arbitrary web script or HTML via a user email address, a different vulnerability than CVE-2014-3475.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
horizon (PTS)	jessie, jessie (lts)	2014.1.3-7+deb8u2	fixed
	stretch	3:10.0.1-1	fixed
	buster	3:14.0.2-3+deb10u2	fixed
	buster (security)	3:14.0.2-3+deb10u3	fixed
	bullseye	3:18.6.2-5+deb11u2	fixed
	bookworm	3:23.0.0-5+deb12u1	fixed
	sid, trixie	3:24.0.0-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
horizon	source	wheezy	(not affected)
horizon	source	(unstable)	2014.1.1-3

[wheezy] - horizon <not-affected> (Vulnerable code not present)
this was split from CVE-2014-3475 by MITRE