The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.2.2 and 2014.1.4 allows remote authenticated users to read or delete arbitrary files via a full pathname in a file: URL in the image location property.
Name | Vendor | Start Version | End Version |
---|---|---|---|
Openstack | Redhat | 4.0 | 4.0 |
Openstack | Redhat | 5.0 | 5.0 |