CVE-2022-47951

An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data.

• CWE-22
• CWE-22

• https://launchpad.net/bugs/1996188Exploit, Issue Tracking, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/01/msg00040.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/01/msg00041.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/01/msg00042.htmlMailing List, Third Party Advisory
• https://security.openstack.org/ossa/OSSA-2023-002.htmlPatch, Vendor Advisory
• https://www.debian.org/security/2023/dsa-5336Third Party Advisory
• https://www.debian.org/security/2023/dsa-5337Third Party Advisory
• https://www.debian.org/security/2023/dsa-5338Third Party Advisory
• https://launchpad.net/bugs/1996188Exploit, Issue Tracking, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/01/msg00040.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/01/msg00041.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/01/msg00042.htmlMailing List, Third Party Advisory
• https://security.openstack.org/ossa/OSSA-2023-002.htmlPatch, Vendor Advisory
• https://www.debian.org/security/2023/dsa-5336Third Party Advisory
• https://www.debian.org/security/2023/dsa-5337Third Party Advisory
• https://www.debian.org/security/2023/dsa-5338Third Party Advisory

Published

Jan 26, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-47943An issue was discovered in ksmbd in the Linux kernel 5.15 th…8.1
• CVE-2022-47945ThinkPHP Framework before 6.0.14 allows local file inclusion…9.8
• CVE-2022-47946An issue was discovered in the Linux kernel 5.10.x before 5.…5.5
• CVE-2022-47949The Nintendo NetworkBuffer class, as used in Animal Crossing…9.8
• CVE-2022-4795The Galleries by Angie Makes WordPress plugin through 1.67 d…5.4
• CVE-2022-47950An issue was discovered in OpenStack Swift before 2.28.1, 2.…6.5
• CVE-2022-47952lxc-user-nic in lxc through 5.0.1 is installed setuid root, …3.3
• CVE-2022-4796Incorrect Use of Privileged APIs in GitHub repository usemem…8.1
• CVE-2022-47965The issue was addressed with improved memory handling. This …7.8
• CVE-2022-47966Multiple Zoho ManageEngine on-premise products, such as Serv…9.8
• CVE-2022-47967A vulnerability has been identified in Solid Edge (All versi…7.8
• CVE-2022-47968Heimdall Application Dashboard through 2.5.4 allows reflecte…5.4