CVEvulnerability

CVE-2022-3146

5.5 MEDIUM Published 2023-03-23 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-03-23
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-22, CWE-276, CWE-732

Description

A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attacker to use brute force to explore the relevant directory and discover the file. This issue leads to information disclosure of important configuration details from the OpenStack deployment.

Affected configurations

• openstack tripleo ansible • redhat openstack 16.1 • redhat openstack 16.2 • redhat openstack for ibm power 16.1 • redhat openstack for ibm power 16.2

Related

Weakness · CWE (3)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
  • CWE-276 Incorrect Default Permissions weakness
  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References