Glance

  1. Bug #1522524
  2. Comment #9

Comment 9 for bug 1522524

Revision history for this message
Grant Murphy (gmurphy) wrote :

First draft of impact description -

Title: Lack of ACL on deactivated image deletion request
Reporter: Niall Bunting (HPE)
Products: Glance
Affects: >=2015.1.0

Description:
Niall Bunting of Hewlett Packard Enterprise (HPE) reported a
vulnerability in Glance. Due to a failure to properly restrict
access controls a user may delete images that have been deactivated
by an administrator. A tenant may abuse this flaw to hide malicious
activities from an administrator. All Glance deployments are affected.