Path Traversal in OpenStack Tripleo Ansible
CVE-2022-3146
A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attacker to use brute force to explore the relevant directory and discover the file. This issue leads to information disclosure of important configuration details from the OpenStack deployment.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.002 (10.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 10th percentile — 10.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- OpenStack Tripleo Ansible
- Red Hat OpenStack — versions 16.1, 16.2
- Red Hat OpenStack For IBM Power — versions 16.1, 16.2
- Tripleo-Ansible — versions unkown
Weakness classification (CWE)
References
- access.redhat.com/security/cve/CVE-2022-3146 (Vendor Advisory)
Frequently asked questions
- What is CVE-2022-3146?
- CVE-2022-3146 is a medium-severity vulnerability in OpenStack Tripleo Ansible, classified under Path Traversal. CVSS score: 5.5/10. Published 2023-03-23.
- How severe is CVE-2022-3146?
- Medium severity. CVSS v3 base score is 5.5 out of 10.