CVE-2022-3146

CWE-22 — Path TraversalCWE-276 — Incorrect Default PermissionsCWE-732 — Incorrect Permission Assignment5 documents5 sources
Severity
5.5MEDIUM
EPSS
0.0%
top 95.19%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Redhat OpenstackRedhat Openstack FOR IBM Power
Timeline
PublishedMar 23

Description

A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attacker to use brute force to explore the relevant directory and discover the file. This issue leads to information disclosure of important configuration details from the OpenStack deployment.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages3 packages

▶PyPItripleo-ansible6.0.0
▶CVEListV5tripleo-ansibleunkown
▶NVDredhat/openstack16.1, 16.2+1

🔴Vulnerability Details

3
OSV
tripleo-ansible may disclose important configuration details from an OpenStack deployment↗2023-03-23
▶
CVEList
CVE-2022-3146: A flaw was found in tripleo-ansible↗2023-03-23
▶
GHSA
tripleo-ansible may disclose important configuration details from an OpenStack deployment↗2023-03-23
▶

📋Vendor Advisories

1
Red Hat
tripleo-ansible: /etc/openstack/clouds.yaml discoverable↗2022-09-02
▶