{"id":"DEBIAN-CVE-2020-29565","details":"An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the \"next\" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL.","modified":"2026-09-11T11:02:34.070377867Z","published":"2020-12-04T08:15:11.143Z","upstream":["CVE-2020-29565"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2020-29565"}],"affected":[{"package":{"name":"horizon","ecosystem":"Debian:12","purl":"pkg:deb/debian/horizon?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:18.6.1-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-29565.json"}},{"package":{"name":"horizon","ecosystem":"Debian:13","purl":"pkg:deb/debian/horizon?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:18.6.1-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-29565.json"}},{"package":{"name":"horizon","ecosystem":"Debian:14","purl":"pkg:deb/debian/horizon?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:18.6.1-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-29565.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}