Vulnerabilities > CVE-2022-44020 - Improper Preservation of Permissions vulnerability in multiple products

CVSS 5.5 - MEDIUM

Attack vector

LOCAL

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

NONE

Integrity impact

HIGH

Availability impact

NONE

local

low complexity

opendev

fedoraproject

CWE-281

NVD

Published: 2022-10-30

Updated: 2023-11-07

Summary

An issue was discovered in OpenStack Sushy-Tools through 0.21.0 and VirtualBMC through 2.2.2. Changing the boot device configuration with these packages removes password protection from the managed libvirt XML domain. NOTE: this only affects an "unsupported, production-like configuration."

Vulnerable Configurations

Part	Description	Count
Application	Opendev Opendev Sushy Tools - Opendev Sushy Tools 0.1.0 Opendev Sushy Tools 0.2.0 Opendev Sushy Tools 0.3.0 Opendev Sushy Tools 0.4.0 Opendev Sushy Tools 0.5.0 Opendev Sushy Tools 0.6.0 Opendev Sushy Tools 0.7.0 Opendev Sushy Tools 0.8.0 Opendev Sushy Tools 0.9.0 Opendev Sushy Tools 0.10.0 Opendev Sushy Tools 0.11.0 Opendev Sushy Tools 0.11.1 Opendev Sushy Tools 0.12.0 Opendev Sushy Tools 0.12.1 Opendev Sushy Tools 0.13.0 Opendev Sushy Tools 0.14.0 Opendev Sushy Tools 0.15.0 Opendev Sushy Tools 0.16.0 Opendev Sushy Tools 0.17.0 Opendev Sushy Tools 0.18.0 Opendev Sushy Tools 0.18.1 Opendev Sushy Tools 0.18.2 Opendev Sushy Tools 0.19.0 Opendev Sushy Tools 0.20.0 Opendev Sushy Tools 0.21.0 Opendev Virtualbmc 0.1.0 Opendev Virtualbmc 1.0.0 Opendev Virtualbmc 1.1.0 Opendev Virtualbmc 1.2.0 Opendev Virtualbmc 1.3.0 Opendev Virtualbmc 1.4.0 Opendev Virtualbmc 1.5.0 Opendev Virtualbmc 1.6.0 Opendev Virtualbmc 2.0.0 Opendev Virtualbmc 2.1.0 Opendev Virtualbmc 2.2.0 Opendev Virtualbmc 2.2.1 Opendev Virtualbmc 2.2.2	39
OS	Fedoraproject Fedoraproject Fedora 35 Fedoraproject Fedora 36 Fedoraproject Fedora 37	3

Common Weakness Enumeration (CWE)

CWE-281 - Improper Preservation of Permissions

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References