CyberRota Analysis
AI-GeneratedThe OpenStack Glance /v2/tasks API is vulnerable to server-side request forgery (SSRF) due to improper handling of import tasks, allowing admins to access internal URLs within the Glance service network. Although the severity is low, this vulnerability could expose sensitive internal resources if exploited. Organizations using OpenStack Glance, particularly those with administrative access, should prioritize remediation efforts to mitigate potential risks associated with this flaw.
Original NVD Description
In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import_filtering_opts, allowing an admin to fetch internal URLs from the Glance service network (aka SSRF), as long as https:// or http:// is used. This API has been available only to admins since Xena, and it has been deprecated for several releases.