Vulnerability · Published Mar 23, 2023 · Assigned by redhat
CVE-2022-3146
Medium 5.5
In plain English
A medium-severity path traversal in tripleo-ansible. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).
Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)0.2%top 89.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attacker to use brute force to explore the relevant directory and discover the file. This issue leads to information disclosure of important configuration details from the OpenStack deployment.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | tripleo-ansible | no fix listed | GHSA-w4x6-6w3r-9h2m |
| PyPI | tripleo-ansible | no fix listed | PYSEC-2026-1052 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | tripleo-ansible | unkown |
Weakness: CWE-22