CVE-2022-3146: Path Traversal
A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attacker to use brute force to explore the relevant directory and discover the file. This issue leads to information disclosure of important configuration details from the OpenStack deployment.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-3146?
CVE-2022-3146 is a vulnerability found in tripleo-ansible that allows a local attacker to use brute force to explore a directory and discover a sensitive file, leading to information disclosure.
What is the severity of CVE-2022-3146?
CVE-2022-3146 has a severity rating of 5.5 (medium).
Which software is affected by CVE-2022-3146?
The following software versions are affected: Openstack Tripleo Ansible, Redhat Openstack 16.1, Redhat Openstack 16.2, Redhat Openstack For Ibm Power 16.1, and Redhat Openstack For Ibm Power 16.2.
How does CVE-2022-3146 affect the affected software?
CVE-2022-3146 affects the affected software by having an insecure default configuration that does not sufficiently restrict the permissions of a sensitive file. This allows a local attacker to explore the relevant directory and discover the file, leading to information disclosure.
How can CVE-2022-3146 be fixed?
To fix CVE-2022-3146, it is recommended to apply the relevant security patch provided by the software vendor.