CVE-2022-37424: The FILES Directive allows arbitrary files from the frontend system (including sensitive files) to be included when a VM is started from that template, which may result in Information Disclosure.
Published Oct 28, 2022
·Updated
Files or Directories Accessible to External Parties vulnerability in OpenNebula on Linux allows File Discovery.
Affected Software
4 affected components
OpenNebula OpenNebula<6.4.2
Linux Linux kernel
All of the following
OpenNebula OpenNebula<6.4.2
Linux Linux kernel
Remediation
Information
Upgrade to OpenNebula 6.4.2 EE LTS
Event History
Oct 28, 2022
CVE Published
03:09 PM
Data Sourced
03:09 PM
RemedyDescriptionSeverity
Frequently Asked Questions
1
What is the severity of CVE-2022-37424?
CVE-2022-37424 has been classified as a medium severity vulnerability.
2
How do I fix CVE-2022-37424?
To fix CVE-2022-37424, upgrade OpenNebula to version 6.4.2 or later.
3
What systems are affected by CVE-2022-37424?
CVE-2022-37424 affects OpenNebula versions prior to 6.4.2 running on Linux.
4
What type of vulnerability is CVE-2022-37424?
CVE-2022-37424 is a Files or Directories Accessible to External Parties vulnerability.
5
Can CVE-2022-37424 be exploited remotely?
Yes, CVE-2022-37424 can potentially be exploited by external parties to discover files.