CVE-2021-4472

Published: Nov 26, 2025Modified: Jun 17, 2026Deferred

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: secalert@redhat.com (Secondary)

Description

The mistral-dashboard plugin for openstack has a local file inclusion vulnerability through the 'Create Workbook' feature that may result in disclosure of arbitrary local files content.

Related CWEs

CWE-73

External Control of File Name or Path

The product allows user input to control or influence paths or file names that are used in filesystem operations.

References (7)

https://access.redhat.com/security/cve/CVE-2021-4472

Source: secalert@redhat.com

https://bugs.launchpad.net/horizon/+bug/1931558

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2417321

Source: secalert@redhat.com

https://review.opendev.org/c/openstack/mistral-dashboard/+/800952

Source: secalert@redhat.com

https://review.opendev.org/c/openstack/python-mistralclient/+/800950

Source: secalert@redhat.com

https://lists.debian.org/debian-lts-announce/2025/12/msg00002.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.debian.org/debian-lts-announce/2025/12/msg00003.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.