PT-2022-5772 · Openstack · Openstack Platform

Nick Tait · Published 2022-12-05 · Updated 2024-05-03 · CVE-2022-3596

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Platform (affected versions not specified)

Description The issue is related to an information leak found in OpenStack's undercloud, which allows unauthenticated, remote attackers to inspect sensitive data after discovering the IP address of the undercloud. This could lead to compromising private information, including administrator access credentials.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-402

Related Identifiers

BDU:2022-07172

CVE-2022-3596

RHSA-2022:8897

Affected Products

Openstack Platform

References · 13

• https://bugzilla.redhat.com/show_bug.cgi?id=2136596 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-07172 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3596 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2022:8897 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3596 · Security Note
• https://access.redhat.com/security/cve/CVE-2022-3596 · Vendor Advisory
• https://t.me/cvenotify/79057 · Telegram Post
• https://t.me/cvenotify/58225 · Telegram Post
• https://twitter.com/CVEnew/status/1704577234109919634 · Twitter Post
• https://twitter.com/DMFezzaReedCISA/status/1704619863790997832 · Twitter Post
• https://t.me/cibsecurity/70854 · Telegram Post
• https://access.redhat.com/security/cve/cve-2022-3596 · Note
• https://twitter.com/cracbot/status/1704737301363151195 · Twitter Post