CVE-2022-47951
An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data.
- Affected products
- Alt Linux, Linuxmint, Openstack Cinder, Openstack Glance, Openstack Nova, Ubuntu
- Openstack Cinder
- ≤ 19.1.2, 20.0.2
- Openstack Glance
- < 23.0.1, 24.1.1
- Openstack Nova
- < 24.1.2, 25.0.2
- Fix
- Available
- CVSS 3.1
- 5.7 MEDIUM
- EPSS
- 1.0% (60th percentile)
- Weakness
- CWE-22
- NVD status
- Modified
- Published
- 2023-01-26
CVE-2022-47951 at NVD
No indexed exploits for CVE-2022-47951 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2022-47951 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.