CVE-2022-3146
Last modified
CVE-2022-3146 is a medium-severity vulnerability rated 5.5/10 on the CVSS scale. A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. EPSS estimates a 0.20% chance of exploitation in the next 30 days.
Description
A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attacker to use brute force to explore the relevant directory and discover the file. This issue leads to information disclosure of important configuration details from the OpenStack deployment.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Openstack | Tripleo Ansible | All versions |
| Redhat | Openstack | 16.1 |
| Redhat | Openstack | 16.2 |
| Redhat | Openstack For Ibm Power | 16.1 |
| Redhat | Openstack For Ibm Power | 16.2 |
References
- https://access.redhat.com/security/cve/CVE-2022-3146Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2022-3146Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-3146?
How severe is CVE-2022-3146?
How do I fix CVE-2022-3146?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-31454Yii 2 v2.0.45 was discovered to contain a cross-site scripti…6.1
- CVE-2022-31455* A cross-site scripting (XSS) vulnerability in Truedesk v1.…6.1
- CVE-2022-31456A cross-site scripting (XSS) vulnerability in Truedesk v1.2.…6.1
- CVE-2022-31457RTX TRAP v1.0 allows attackers to perform a directory traver…7.5
- CVE-2022-31458RTX TRAP v1.0 was discovered to be vulnerable to host header…6.1
- CVE-2022-31459Owl Labs Meeting Owl 5.2.0.15 allows attackers to retrieve t…6.5
- CVE-2022-31460Owl Labs Meeting Owl 5.2.0.15 allows attackers to activate T…7.4
- CVE-2022-31461Owl Labs Meeting Owl 5.2.0.15 allows attackers to deactivate…6.5
- CVE-2022-31462Owl Labs Meeting Owl 5.2.0.15 allows attackers to control th…8.8
- CVE-2022-31463Owl Labs Meeting Owl 5.2.0.15 does not require a password fo…7.1
- CVE-2022-31464Insecure permissions configuration in Adaware Protect v1.2.4…7.8
- CVE-2022-31465A vulnerability has been identified in Xpedition Designer VX…7.8
Are you affected by CVE-2022-3146?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST