Vulnerability Database

289,599

Total vulnerabilities in the database

CVE-2022-47951

An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data.

CVSS v3:

  • Severity: Medium
  • Score: 5.7
  • AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

CWEs:

OWASP TOP 10:

Software From Fixed in
openstack / nova 25.0.0 25.0.2
openstack / glance 24.0.0 24.1.1
openstack / cinder 20.0.0 20.0.2
openstack / cinder - 19.1.2.x
openstack / nova - 24.1.2
openstack / glance - 23.0.1
debian / debian_linux 10.0 10.0.x
debian / debian_linux 11.0 11.0.x
cinder - 19.1.2
cinder 20.0.0 20.0.2
glance - 23.0.1
glance 24.0.0 24.1.1
nova - 24.1.2
nova 25.0.0 25.0.2