Threats tagged 'ghsa-3q4x-35gh-jfxh'

Glance versions from 0.8.0 up to but not including 0.8.8 have a vulnerability where unauthenticated attackers can enumerate configured page slugs by observing differences in HTTP response codes. This occurs due to discrepancies in the handlePageRequest and handlePageContentRequest endpoints, allowing attackers to distinguish valid page names from invalid ones based on 303/401 versus 404 status codes.