« Volver al listado

CVE-2022-3100

Estado: ModificadaMedia (5.9)—

A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (4)

Openstack — BarbicanRedhat — OpenstackRedhat — Openstack FOR IBM PowerRedhat — Openstack Platform

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-3100",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-3100",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-02T17:55:00.610784Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 1.6
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 1.6
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Red Hat OpenStack Platform",
          "versions": [
            {
              "status": "affected",
              "version": "13.0-17.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-01-18T17:15:10.173",
  "references": [
    {
      "url": "https://access.redhat.com/security/cve/CVE-2022-3100",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2022-3100",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secalert@redhat.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-305"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API."
    },
    {
      "lang": "es",
      "value": "Se encontró una falla en el componente openstack-barbican. Este problema permite omitir la política de acceso a través de una cadena de consulta al acceder a la API."
    }
  ],
  "lastModified": "2026-06-17T04:58:51.457",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:openstack:barbican:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "596EFC6C-4D91-4EDF-9EC6-1C58EB485C5E"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:openstack:13:*:*:*:els:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BC52495A-0275-4FC5-869B-7137E7FE115E"
            },
            {
              "criteria": "cpe:2.3:a:redhat:openstack:16.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C9D3F4FF-AD3D-4D17-93E8-84CAFCED2F59"
            },
            {
              "criteria": "cpe:2.3:a:redhat:openstack:16.2:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FFE398FE-EE7C-4B64-ABB6-24697E047C85"
            },
            {
              "criteria": "cpe:2.3:a:redhat:openstack:17:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BC12AF01-CCDD-4AB6-8F44-32058A63BAFB"
            },
            {
              "criteria": "cpe:2.3:a:redhat:openstack_for_ibm_power:13:*:*:*:els:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1669C672-84CB-46D7-802A-4489749C8821"
            },
            {
              "criteria": "cpe:2.3:a:redhat:openstack_for_ibm_power:16.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D272E454-64F0-4BD2-9EE8-B2A48023758A"
            },
            {
              "criteria": "cpe:2.3:a:redhat:openstack_for_ibm_power:16.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8DD273B9-4536-42E5-9F90-52408D263B22"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:openstack_platform:13.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C52600BF-9E87-4CD2-91F3-685AFE478C1E"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "5BF3C7A5-9117-42C7-BEA1-4AA378A582EF"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}