CVE-2022-3100 - Vulnerability Details

Vendors	Products
Openstack	Barbican
Redhat	Enterprise Linux Eus Openstack Openstack For Ibm Power Openstack Platform

Package	CPE	Advisory	Released Date
Red Hat OpenStack Platform 13.0 - ELS
openstack-barbican-0:6.0.1-6.el7ost	cpe:/a:redhat:openstack:13::el7	RHSA-2022:6750	2022-09-29T00:00:00Z
Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS
openstack-barbican-0:6.0.1-6.el7ost	cpe:/a:redhat:openstack:13::el7	RHSA-2022:6750	2022-09-29T00:00:00Z
Red Hat OpenStack Platform 16.1
openstack-barbican-0:9.0.1-1.20220112203416.07be198.el8ost	cpe:/a:redhat:openstack:16.1::el8	RHSA-2022:6750	2022-09-29T00:00:00Z
Red Hat OpenStack Platform 16.2
openstack-barbican-0:9.0.2-2.20220122185349.c718783.el8ost	cpe:/a:redhat:openstack:16.2::el8	RHSA-2022:6750	2022-09-29T00:00:00Z
Red Hat OpenStack Platform 17.0
openstack-barbican-0:12.0.1-0.20220614210405.486e607.el9ost	cpe:/a:redhat:openstack:17.0::el9	RHSA-2022:6750	2022-09-29T00:00:00Z

Link	Providers
https://access.redhat.com/security/cve/CVE-2022-3100
https://nvd.nist.gov/vuln/detail/CVE-2022-3100
https://www.cve.org/CVERecord?id=CVE-2022-3100

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-3100", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "dateUpdated": "2025-04-03T19:26:10.275Z", "dateReserved": "2022-09-02T00:00:00.000Z", "datePublished": "2023-01-18T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2023-01-18T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API."}], "affected": [{"vendor": "n/a", "product": "Red Hat OpenStack Platform", "versions": [{"version": "13.0-17.0", "status": "affected"}]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2022-3100"}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-305", "cweId": "CWE-305"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T01:00:10.491Z"}, "title": "CVE Program Container", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2022-3100", "tags": ["x_transferred"]}]}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-04-02T17:55:00.610784Z", "id": "CVE-2022-3100", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-03T19:26:10.275Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

state : PUBLISHED (string)

cveId : CVE-2022-3100 (string)

assignerOrgId : 53f830b8-0a3f-465b-8143-3b8a9948e749 (string)

assignerShortName : redhat (string)

dateUpdated : 2025-04-03T19:26:10.275Z (string)

dateReserved : 2022-09-02T00:00:00.000Z (string)

datePublished : 2023-01-18T00:00:00.000Z (string)

}

containers : { »

cna : { »

providerMetadata : { »

orgId : 53f830b8-0a3f-465b-8143-3b8a9948e749 (string)

shortName : redhat (string)

dateUpdated : 2023-01-18T00:00:00.000Z (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API. (string)

}

]

affected : [ »

0 : { »

vendor : n/a (string)

product : Red Hat OpenStack Platform (string)

versions : [ »

0 : { »

version : 13.0-17.0 (string)

status : affected (string)

}

]

}

]

references : [ »

0 : { »

url : https://access.redhat.com/security/cve/CVE-2022-3100 (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : CWE (string)

lang : en (string)

description : CWE-305 (string)

cweId : CWE-305 (string)

}

]

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-03T01:00:10.491Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://access.redhat.com/security/cve/CVE-2022-3100 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

1 : { »

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 5.9 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N (string)

integrityImpact : LOW (string)

userInteraction : NONE (string)

attackComplexity : HIGH (string)

availabilityImpact : NONE (string)

privilegesRequired : LOW (string)

confidentialityImpact : HIGH (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2025-04-02T17:55:00.610784Z (string)

id : CVE-2022-3100 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-04-03T19:26:10.275Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2022-3100", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T01:00:10.491Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2022-3100", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-02T17:55:00.610784Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-02T17:55:57.886Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "Red Hat OpenStack Platform", "versions": [{"status": "affected", "version": "13.0-17.0"}]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2022-3100"}], "descriptions": [{"lang": "en", "value": "A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-305", "description": "CWE-305"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2023-01-18T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2022-3100", "state": "PUBLISHED", "dateUpdated": "2025-04-03T19:26:10.275Z", "dateReserved": "2022-09-02T00:00:00.000Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2023-01-18T00:00:00.000Z", "assignerShortName": "redhat"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://access.redhat.com/security/cve/CVE-2022-3100 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-03T01:00:10.491Z (string)

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 5.9 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N (string)

integrityImpact : LOW (string)

userInteraction : NONE (string)

attackComplexity : HIGH (string)

availabilityImpact : NONE (string)

privilegesRequired : LOW (string)

confidentialityImpact : HIGH (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2022-3100 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2025-04-02T17:55:00.610784Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-04-02T17:55:57.886Z (string)

}

]

cna : { »

affected : [ »

0 : { »

vendor : n/a (string)

product : Red Hat OpenStack Platform (string)

versions : [ »

0 : { »

status : affected (string)

version : 13.0-17.0 (string)

}

]

}

]

references : [ »

0 : { »

url : https://access.redhat.com/security/cve/CVE-2022-3100 (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-305 (string)

description : CWE-305 (string)

}

]

}

]

providerMetadata : { »

orgId : 53f830b8-0a3f-465b-8143-3b8a9948e749 (string)

shortName : redhat (string)

dateUpdated : 2023-01-18T00:00:00.000Z (string)

}

cveMetadata : { »

cveId : CVE-2022-3100 (string)

state : PUBLISHED (string)

dateUpdated : 2025-04-03T19:26:10.275Z (string)

dateReserved : 2022-09-02T00:00:00.000Z (string)

assignerOrgId : 53f830b8-0a3f-465b-8143-3b8a9948e749 (string)

datePublished : 2023-01-18T00:00:00.000Z (string)

assignerShortName : redhat (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openstack:barbican:-:*:*:*:*:*:*:*", "matchCriteriaId": "596EFC6C-4D91-4EDF-9EC6-1C58EB485C5E", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:openstack:13:*:*:*:els:*:*:*", "matchCriteriaId": "BC52495A-0275-4FC5-869B-7137E7FE115E", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:openstack:16.1:*:*:*:*:*:*:*", "matchCriteriaId": "C9D3F4FF-AD3D-4D17-93E8-84CAFCED2F59", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:openstack:16.2:-:*:*:*:*:*:*", "matchCriteriaId": "FFE398FE-EE7C-4B64-ABB6-24697E047C85", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:openstack:17:*:*:*:*:*:*:*", "matchCriteriaId": "BC12AF01-CCDD-4AB6-8F44-32058A63BAFB", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:openstack_for_ibm_power:13:*:*:*:els:*:*:*", "matchCriteriaId": "1669C672-84CB-46D7-802A-4489749C8821", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:openstack_for_ibm_power:16.1:*:*:*:*:*:*:*", "matchCriteriaId": "D272E454-64F0-4BD2-9EE8-B2A48023758A", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:openstack_for_ibm_power:16.2:*:*:*:*:*:*:*", "matchCriteriaId": "8DD273B9-4536-42E5-9F90-52408D263B22", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:openstack_platform:13.0:*:*:*:*:*:*:*", "matchCriteriaId": "C52600BF-9E87-4CD2-91F3-685AFE478C1E", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*", "matchCriteriaId": "5BF3C7A5-9117-42C7-BEA1-4AA378A582EF", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en el componente openstack-barbican. Este problema permite omitir la pol\u00edtica de acceso a trav\u00e9s de una cadena de consulta al acceder a la API."}], "id": "CVE-2022-3100", "lastModified": "2025-04-03T20:15:17.363", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 4.2, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 4.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2023-01-18T17:15:10.173", "references": [{"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/security/cve/CVE-2022-3100"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/security/cve/CVE-2022-3100"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-305"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:openstack:barbican:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 596EFC6C-4D91-4EDF-9EC6-1C58EB485C5E (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

1 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:redhat:openstack:13:*:*:*:els:*:*:* (string)

matchCriteriaId : BC52495A-0275-4FC5-869B-7137E7FE115E (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:redhat:openstack:16.1:*:*:*:*:*:*:* (string)

matchCriteriaId : C9D3F4FF-AD3D-4D17-93E8-84CAFCED2F59 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:redhat:openstack:16.2:-:*:*:*:*:*:* (string)

matchCriteriaId : FFE398FE-EE7C-4B64-ABB6-24697E047C85 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:redhat:openstack:17:*:*:*:*:*:*:* (string)

matchCriteriaId : BC12AF01-CCDD-4AB6-8F44-32058A63BAFB (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:redhat:openstack_for_ibm_power:13:*:*:*:els:*:*:* (string)

matchCriteriaId : 1669C672-84CB-46D7-802A-4489749C8821 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:redhat:openstack_for_ibm_power:16.1:*:*:*:*:*:*:* (string)

matchCriteriaId : D272E454-64F0-4BD2-9EE8-B2A48023758A (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:redhat:openstack_for_ibm_power:16.2:*:*:*:*:*:*:* (string)

matchCriteriaId : 8DD273B9-4536-42E5-9F90-52408D263B22 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

2 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:redhat:openstack_platform:13.0:*:*:*:*:*:*:* (string)

matchCriteriaId : C52600BF-9E87-4CD2-91F3-685AFE478C1E (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:* (string)

matchCriteriaId : 5BF3C7A5-9117-42C7-BEA1-4AA378A582EF (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API. (string)

}

1 : { »

lang : es (string)

value : Se encontró una falla en el componente openstack-barbican. Este problema permite omitir la política de acceso a través de una cadena de consulta al acceder a la API. (string)

}

]

id : CVE-2022-3100 (string)

lastModified : 2025-04-03T20:15:17.363 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : HIGH (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 5.9 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : LOW (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 1.6 (number)

impactScore : 4.2 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

cvssData : { »

attackComplexity : HIGH (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 5.9 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : LOW (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 1.6 (number)

impactScore : 4.2 (number)

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

published : 2023-01-18T17:15:10.173 (string)

references : [ »

0 : { »

source : secalert@redhat.com (string)

tags : [ »

0 : Third Party Advisory (string)

]

url : https://access.redhat.com/security/cve/CVE-2022-3100 (string)

}

1 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Third Party Advisory (string)

]

url : https://access.redhat.com/security/cve/CVE-2022-3100 (string)

}

]

sourceIdentifier : secalert@redhat.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-305 (string)

}

]

source : secalert@redhat.com (string)

type : Secondary (string)

}

]

}

Show plain JSON

{"acknowledgement": "This issue was discovered by Douglas Mendizabal (Red Hat).", "affected_release": [{"advisory": "RHSA-2022:6750", "cpe": "cpe:/a:redhat:openstack:13::el7", "package": "openstack-barbican-0:6.0.1-6.el7ost", "product_name": "Red Hat OpenStack Platform 13.0 - ELS", "release_date": "2022-09-29T00:00:00Z"}, {"advisory": "RHSA-2022:6750", "cpe": "cpe:/a:redhat:openstack:13::el7", "package": "openstack-barbican-0:6.0.1-6.el7ost", "product_name": "Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS", "release_date": "2022-09-29T00:00:00Z"}, {"advisory": "RHSA-2022:6750", "cpe": "cpe:/a:redhat:openstack:16.1::el8", "package": "openstack-barbican-0:9.0.1-1.20220112203416.07be198.el8ost", "product_name": "Red Hat OpenStack Platform 16.1", "release_date": "2022-09-29T00:00:00Z"}, {"advisory": "RHSA-2022:6750", "cpe": "cpe:/a:redhat:openstack:16.2::el8", "package": "openstack-barbican-0:9.0.2-2.20220122185349.c718783.el8ost", "product_name": "Red Hat OpenStack Platform 16.2", "release_date": "2022-09-29T00:00:00Z"}, {"advisory": "RHSA-2022:6750", "cpe": "cpe:/a:redhat:openstack:17.0::el9", "package": "openstack-barbican-0:12.0.1-0.20220614210405.486e607.el9ost", "product_name": "Red Hat OpenStack Platform 17.0", "release_date": "2022-09-29T00:00:00Z"}], "bugzilla": {"description": "openstack-barbican: access policy bypass via query string injection", "id": "2125404", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2125404"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N", "status": "verified"}, "cwe": "CWE-305", "details": ["A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API.", "A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API."], "name": "CVE-2022-3100", "public_date": "2022-09-28T17:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-3100\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-3100"], "threat_severity": "Important"}

{

acknowledgement : This issue was discovered by Douglas Mendizabal (Red Hat). (string)

affected_release : [ »

0 : { »

advisory : RHSA-2022:6750 (string)

cpe : cpe:/a:redhat:openstack:13::el7 (string)

package : openstack-barbican-0:6.0.1-6.el7ost (string)

product_name : Red Hat OpenStack Platform 13.0 - ELS (string)

release_date : 2022-09-29T00:00:00Z (string)

}

1 : { »

advisory : RHSA-2022:6750 (string)

cpe : cpe:/a:redhat:openstack:13::el7 (string)

package : openstack-barbican-0:6.0.1-6.el7ost (string)

product_name : Red Hat OpenStack Platform 13.0 (Queens) for RHEL 7.6 EUS (string)

release_date : 2022-09-29T00:00:00Z (string)

}

2 : { »

advisory : RHSA-2022:6750 (string)

cpe : cpe:/a:redhat:openstack:16.1::el8 (string)

package : openstack-barbican-0:9.0.1-1.20220112203416.07be198.el8ost (string)

product_name : Red Hat OpenStack Platform 16.1 (string)

release_date : 2022-09-29T00:00:00Z (string)

}

3 : { »

advisory : RHSA-2022:6750 (string)

cpe : cpe:/a:redhat:openstack:16.2::el8 (string)

package : openstack-barbican-0:9.0.2-2.20220122185349.c718783.el8ost (string)

product_name : Red Hat OpenStack Platform 16.2 (string)

release_date : 2022-09-29T00:00:00Z (string)

}

4 : { »

advisory : RHSA-2022:6750 (string)

cpe : cpe:/a:redhat:openstack:17.0::el9 (string)

package : openstack-barbican-0:12.0.1-0.20220614210405.486e607.el9ost (string)

product_name : Red Hat OpenStack Platform 17.0 (string)

release_date : 2022-09-29T00:00:00Z (string)

}

]

bugzilla : { »

description : openstack-barbican: access policy bypass via query string injection (string)

id : 2125404 (string)

url : https://bugzilla.redhat.com/show_bug.cgi?id=2125404 (string)

}

csaw : false (boolean)

cvss3 : { »

cvss3_base_score : 7.1 (string)

cvss3_scoring_vector : CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N (string)

status : verified (string)

}

cwe : CWE-305 (string)

details : [ »

0 : A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API. (string)

1 : A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API. (string)

]

name : CVE-2022-3100 (string)

public_date : 2022-09-28T17:00:00Z (string)

references : [ »

0 : https://www.cve.org/CVERecord?id=CVE-2022-3100 https://nvd.nist.gov/vuln/detail/CVE-2022-3100 (string)

]

threat_severity : Important (string)

}

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object