CVE-2022-3101

CWE-22 — Path TraversalCWE-276 — Incorrect Default PermissionsCWE-732 — Incorrect Permission Assignment6 documents6 sources
Severity
5.5MEDIUM
EPSS
0.0%
top 95.19%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Redhat OpenstackRedhat Openstack FOR IBM Power
Timeline
PublishedMar 23

Description

A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attacker to use brute force to explore the relevant directory and discover the file, leading to information disclosure of important configuration details from the OpenStack deployment.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages3 packages

▶PyPItripleo-ansible6.0.0
▶CVEListV5tripleo-ansibleunknown
▶NVDredhat/openstack16.1, 16.2+1

🔴Vulnerability Details

3
CVEList
CVE-2022-3101: A flaw was found in tripleo-ansible↗2023-03-23
▶
OSV
tripleo-ansible may disclose important configuration details from an OpenStack deployment↗2023-03-23
▶
GHSA
tripleo-ansible may disclose important configuration details from an OpenStack deployment↗2023-03-23
▶

📋Vendor Advisories

1
Red Hat
tripleo-ansible: /var/lib/mistral/overcloud discoverable↗2022-09-02
▶