PT-2023-13042 · Unknown · Tripleo-Ansible

Maciej Relewicz · Published 2023-03-23 · Updated 2023-03-30 · CVE-2022-3146

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions tripleo-ansible (affected versions not specified)

Description A flaw in the default configuration of tripleo-ansible causes insufficient restriction of permissions for a sensitive file. This allows a local attacker to use brute force to explore the relevant directory and discover the file, leading to information disclosure of important OpenStack deployment configuration details.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Incorrect Default Permissions

Path traversal

Weakness Enumeration

CWE-732

CWE-276

CWE-22

Related Identifiers

CVE-2022-3146

GHSA-W4X6-6W3R-9H2M

RHSA-2022:6969

Affected Products

Tripleo-Ansible

References · 5

• https://access.redhat.com/security/cve/CVE-2022-3146 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3146 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3146 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w4x6-6w3r-9h2m · Vendor Advisory
• https://github.com/openstack/tripleo-ansible · Note