CVE-2022-44020

An issue was discovered in OpenStack Sushy-Tools through 0.21.0 and VirtualBMC through 2.2.2. Changing the boot device configuration with these packages removes password protection from the managed libvirt XML domain. NOTE: this only affects an "unsupported, production-like configuration."

• CWE-281
• CWE-281

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GAD7QJIUWPCKJIGYP7PPHH5DILOEONFE/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KEQVJF3OQGSDCSQTQQSC54JEGLMSNB4Q/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QMSUGS4B6EBRHBJMTRXL5RIKJTZTEMJC/
• https://review.opendev.org/c/openstack/sushy-tools/+/862625Patch, Vendor Advisory
• https://review.opendev.org/c/openstack/virtualbmc/+/862620Patch, Vendor Advisory
• https://storyboard.openstack.org/#%21/story/2010382
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GAD7QJIUWPCKJIGYP7PPHH5DILOEONFE/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KEQVJF3OQGSDCSQTQQSC54JEGLMSNB4Q/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QMSUGS4B6EBRHBJMTRXL5RIKJTZTEMJC/
• https://review.opendev.org/c/openstack/sushy-tools/+/862625Patch, Vendor Advisory
• https://review.opendev.org/c/openstack/virtualbmc/+/862620Patch, Vendor Advisory
• https://storyboard.openstack.org/#%21/story/2010382

Published

Oct 30, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-44015An issue was discovered in Simmeth Lieferantenmanager before…9.8
• CVE-2022-44016An issue was discovered in Simmeth Lieferantenmanager before…7.5
• CVE-2022-44017An issue was discovered in Simmeth Lieferantenmanager before…7.5
• CVE-2022-44018In Softing uaToolkit Embedded before 1.40.1, a malformed Pub…7.5
• CVE-2022-44019In Total.js 4 before 0e5ace7, /api/common/ping can achieve r…8.8
• CVE-2022-4402A vulnerability classified as critical has been found in Rai…7.2
• CVE-2022-44022PwnDoc through 0.5.3 might allow remote attackers to identif…5.3
• CVE-2022-44023PwnDoc through 0.5.3 might allow remote attackers to identif…5.3
• CVE-2022-44024An issue was discovered in NetScout nGeniusONE 6.3.2 before …6.1
• CVE-2022-44025An issue was discovered in NetScout nGeniusONE 6.3.2 before …6.1
• CVE-2022-44026An issue was discovered in NetScout nGeniusONE 6.3.2 before …6.1
• CVE-2022-44027An issue was discovered in NetScout nGeniusONE 6.3.2 before …6.1