Path Traversal in OpenStack Tripleo Ansible
CVE-2022-3146
A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attacker to use brute force to explore the relevant directory and discover the file. This issue leads to information disclosure of important configuration details from the OpenStack deployment.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.002 (10.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Openstack Tripleo_ansible
- Redhat Openstack — versions 16.1, 16.2
- Redhat Openstack_for_ibm_power — versions 16.1, 16.2
- N/a Tripleo-ansible — versions unkown
Weakness classification (CWE)
References
- secalert@redhat.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2022-3146?
- CVE-2022-3146 is a medium-severity vulnerability in OpenStack Tripleo Ansible, classified under Path Traversal. CVSS score: 5.5/10. Published 2023-03-23.
- How severe is CVE-2022-3146?
- Medium severity. CVSS v3 base score is 5.5 out of 10.