CVE-2021-4472

EUVD-2021-34723
The mistral-dashboard plugin for openstack has a local file inclusion vulnerability through the 'Create Workbook' feature that may result in disclosure of arbitrary local files content.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 38.24%
Debian logo
Debian Releases
Debian Product
Codename
mistral-dashboard
bookworm
15.0.0-2
fixed
bullseye
vulnerable
bullseye (security)
11.0.0-2+deb11u1
fixed
forky
22.0.0-1
fixed
sid
22.0.0-1
fixed
trixie
20.0.0-1
fixed
python-mistralclient
bookworm
1:4.5.0-2
fixed
bullseye
vulnerable
bullseye (security)
1:4.1.1-2+deb11u1
fixed
forky
1:6.2.0-2
fixed
sid
1:6.2.0-2
fixed
trixie
1:5.4.0-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
mistral-dashboard
focal
needs-triage
jammy
needs-triage
noble
needs-triage
plucky
needs-triage
questing
needs-triage
Common Weakness Enumeration
References
https://access.redhat.com/security/cve/CVE-2021-4472
https://bugs.launchpad.net/horizon/+bug/1931558
https://bugzilla.redhat.com/show_bug.cgi?id=2417321
https://review.opendev.org/c/openstack/mistral-dashboard/+/800952
https://review.opendev.org/c/openstack/python-mistralclient/+/800950
https://lists.debian.org/debian-lts-announce/2025/12/msg00002.html
https://lists.debian.org/debian-lts-announce/2025/12/msg00003.html