Main Vulnerability Database Vulnerabilities #VU70050

Incorrect permission assignment for critical resource in Red Hat OpenStack - CVE-2022-1655

Published: December 8, 2022

Vulnerability identifier: #VU70050

CSH Severity: Low

CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-1655

CWE-ID: CWE-732

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to Horizon session cookies are created without the HttpOnly flag despite HorizonSecureCookies being set to true in the environmental files. A remote attacker can gain unauthorized access to potential sensitive information.

Affected software

Red Hat OpenStack
python-django-horizon (Red Hat package)

How to mitigate CVE-2022-1655

Install updates from vendor's website.

Red Hat OpenStack - update to 16.2.4
python-django-horizon (Red Hat package) - update to 16.2.3-2.20220926144724.d3d3d18.el8ost

External References

Related Security Bulletins