CVE-2022-3146

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-03-23 · updated 2026-06-17
Weakness: CWE-22

Description

A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attacker to use brute force to explore the relevant directory and discover the file. This issue leads to information disclosure of important configuration details from the OpenStack deployment.

Affected products

OpenStack Tripleo Ansible: all versions
OpenStack: 16.1, 16.2
RedHat Openstack For Ibm Power: 16.1, 16.2

References

https://access.redhat.com/security/cve/CVE-2022-3146
https://access.redhat.com/security/cve/CVE-2022-3146

Get alerted when CVE-2022-3146 or the next vulnerability affects your stack