PT-2022-14026 · Red Hat · Red Hat Openstack Horizon

Riccardo Bruzzone · Published 2022-07-22 · Updated 2022-07-29 · CVE-2022-1655

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Red Hat OpenStack Horizon (affected versions not specified)

Description An issue was found in Horizon on Red Hat OpenStack where session cookies are created without the HttpOnly flag, despite the HorizonSecureCookies setting being set to true. This could lead to a loss of confidentiality and integrity.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2022-1655

RHSA-2022:8856

Affected Products

Red Hat Openstack Horizon

References · 4

• https://osv.dev/vulnerability/CVE-2022-1655 · Vendor Advisory
• https://access.redhat.com/security/cve/cve-2022-1655 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1655 · Security Note
• https://t.me/cibsecurity/46809 · Telegram Post