CVE-2015-3988

launchpad.net Bug Description:
-----------------------------------------------------
1) Start up Horizon
2) Go to Images
3) Next to an image, pick "Update Metadata"
4) From the dropdown button, select "Update Metadata"
5) In the Custom box, enter a value with some HTML like '</script><script>alert(1)</script>//', click +
6) On the right-hand side, give it a value, like "ee"
7) Click "Save"
8) Pick "Update Metadata" for the image again, the page will fail to load, and the JavaScript console says:

SyntaxError: invalid property id
var existing_metadata = {"

An alternative is if you change the URL to update_metadata for the image (for example, http://192.168.122.239/admin/images/fa62ba27-e731-4ab9-8487-f31bac355b4c/update_metadata/), it will actually display the alert box and a bunch of junk.

I'm not sure if update_metadata is actually a page, though... can't figure out how to get to it other than typing it in.
-----------------------------------------------------

References:
http://www.openwall.com/lists/oss-security/2015/05/12/9
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3988
http://seclists.org/oss-sec/2015/q2/463
http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-3988.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3988
https://bugs.launchpad.net/horizon/+bug/1449260