1. Home
  2. CVE Database
  3. CVE-2022-3146
MEDIUM · 5.5

CVE-2022-3146

A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attacker to use brute force...

Vulnerability Description

A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attacker to use brute force to explore the relevant directory and discover the file. This issue leads to information disclosure of important configuration details from the OpenStack deployment.

CVSS Score

5.5

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
OpenstackTripleo Ansible-
RedhatOpenstack16.1
RedhatOpenstack For Ibm Power16.1

Related Weaknesses (CWE)

CWE-22CWE-732CWE-276

References

FAQ

What is CVE-2022-3146?

CVE-2022-3146 is a vulnerability with a CVSS score of 5.5 (MEDIUM). A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attacker to use brute force...

How severe is CVE-2022-3146?

CVE-2022-3146 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-3146?

Check the references section above for vendor advisories and patch information. Affected products include: Openstack Tripleo Ansible, Redhat Openstack, Redhat Openstack For Ibm Power.