Description (CNA)
In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement. Any holder of a valid Mistral token, regardless of assigned role, can read and change the service's cluster-wide maintenance state. Setting the state to PAUSED stops processing of new workflow and execution objects across all tenant projects until an operator restores it.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| OpenStack / Mistral | affected 0 before 20.1.1; affected 21.0.0 before 21.0.1; affected 22.0.0 before 22.0.1; affected 23.0.0 |
CWE
CWE-862
References
ADP enrichment
No English description supplied.