Read the docs
TI-2020-17754 Aliases CVE-2020-29565GHSA-f8fh-xp28-q59m

An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and…

Priority LOW 30CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 3 fixed, 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-601.

Summary

An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the "next" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL.

Why it matters now

EPSS 0.01423 73rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial horizon (PyPI): 15.3.2, 16.2.1, 18.3.3 +1Red Hat: 2 advisoriesRed Hat: 3 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—horizon (PyPI)before 15.3.215.3.2Patch availableGHSA-f8fh-xp28-q59m
—horizon (PyPI)16.0.0 to before 16.2.116.2.1Patch availableGHSA-f8fh-xp28-q59m
—horizon (PyPI)17.0.0 to before 18.3.318.3.3Patch availableGHSA-f8fh-xp28-q59m
—horizon (PyPI)18.4.0 to before 18.6.018.6.0Patch availableGHSA-f8fh-xp28-q59m
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • horizon (PyPI) Vendor— Affected before 15.3.2 Fixed in 15.3.2 Patch available GHSA-f8fh-xp28-q59m
  • horizon (PyPI) Vendor— Affected 16.0.0 to before 16.2.1 Fixed in 16.2.1 Patch available GHSA-f8fh-xp28-q59m
  • horizon (PyPI) Vendor— Affected 17.0.0 to before 18.3.3 Fixed in 18.3.3 Patch available GHSA-f8fh-xp28-q59m
  • horizon (PyPI) Vendor— Affected 18.4.0 to before 18.6.0 Fixed in 18.6.0 Patch available GHSA-f8fh-xp28-q59m

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:openstack:horizon:*:*:*:*:*:*:*:*15.3.0 to before 15.3.2; 16.0.0 to before 16.2.1; 17.0.0 to before 18.3.3; 18.4.0 – 18.5.0VulnerableOpenStack
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
  • cpe:2.3:a:openstack:horizon:*:*:*:*:*:*:*:* Versions 15.3.0 to before 15.3.2; 16.0.0 to before 16.2.1; 17.0.0 to before 18.3.3; 18.4.0 – 18.5.0 Vulnerable ·OpenStack
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian

Remediation

  • Fix · GHSA-f8fh-xp28-q59m horizon (PyPI) Fixed in 15.3.2 Advisory →
  • Fix · GHSA-f8fh-xp28-q59m horizon (PyPI) Fixed in 16.2.1 Advisory →
  • Fix · GHSA-f8fh-xp28-q59m horizon (PyPI) Fixed in 18.3.3 Advisory →
  • Fix · GHSA-f8fh-xp28-q59m horizon (PyPI) Fixed in 18.6.0 Advisory →

Red Hat 2 advisories

  • RHSA-2020:5572 Released 2020-12-16 · Red Hat rating Moderate
    python-django-horizon security update
    • Red Hat OpenStack Platform 13.0 openstack-dashboard-1:13.0.3-7.el7ost, python-django-horizon-1:13.0.3-7.el7ost
    • Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server openstack-dashboard-1:13.0.3-7.el7ost, python-django-horizon-1:13.0.3-7.el7ost
  • RHSA-2020:5411 Released 2020-12-15 · Red Hat rating Moderate
    python-django-horizon security update
    • Red Hat OpenStack Platform 16.1 openstack-dashboard-1:16.2.1-1.20201114033610.el8ost, python-django-horizon-1:16.2.1-1.20201114033610.el8ost, python3-django-horizon-1:16.2.1-1.20201114033610.el8ost

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 15 (Stein)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13.0Fixed RHSA-2020:5572
Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS ServerFixed RHSA-2020:5572
Red Hat OpenStack Platform 16.1Fixed RHSA-2020:5411

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-29565
  2. 2026-10-03 Alias added: GHSA-f8fh-xp28-q59m

References

Exploit 1

Patch 4

Advisory 2

Other 8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences