CVE-2022-3101
Last modified
CVE-2022-3101 is a medium-severity vulnerability rated 5.5/10 on the CVSS scale. A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. EPSS estimates a 0.20% chance of exploitation in the next 30 days.
Description
A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attacker to use brute force to explore the relevant directory and discover the file, leading to information disclosure of important configuration details from the OpenStack deployment.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Openstack | Tripleo Ansible | All versions |
| Redhat | Openstack | 16.1 |
| Redhat | Openstack | 16.2 |
| Redhat | Openstack For Ibm Power | 16.1 |
| Redhat | Openstack For Ibm Power | 16.2 |
References
- https://access.redhat.com/security/cve/CVE-2022-3101Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2022-3101Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-3101?
How severe is CVE-2022-3101?
How do I fix CVE-2022-3101?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-31004CVEProject/cve-services is an open source project used to op…7.5
- CVE-2022-31005Vapor is an HTTP web framework for Swift. Users of Vapor pri…7.5
- CVE-2022-31006indy-node is the server portion of Hyperledger Indy, a distr…7.5
- CVE-2022-31007eLabFTW is an electronic lab notebook manager for research t…7.2
- CVE-2022-31008RabbitMQ is a multi-protocol messaging and streaming broker.…7.5
- CVE-2022-31009wire-ios is an iOS client for the Wire secure messaging appl…6.5
- CVE-2022-31011TiDB is an open-source NewSQL database that supports Hybrid …7.8
- CVE-2022-31012Git for Windows is a fork of Git that contains Windows-speci…7.3
- CVE-2022-31013Chat Server is the chat server for Vartalap, an open-source …9.8
- CVE-2022-31014Nextcloud server is an open source personal cloud server. Af…3.5
- CVE-2022-31015Waitress is a Web Server Gateway Interface server for Python…5.9
- CVE-2022-31016Argo CD is a declarative continuous deployment for Kubernete…6.5
Are you affected by CVE-2022-3101?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST