CVE-2022-1655

6.5 mediumEPSS 0.6%

Medium (6.5) in redhat openstack. EPSS 0.6% chance of exploitation in the next 30 days.

An Incorrect Permission Assignment for Critical Resource flaw was found in Horizon on Red Hat OpenStack. Horizon session cookies are created without the HttpOnly flag despite HorizonSecureCookies being set to true in the environmental files, possibly leading to a loss of confidentiality and integrity.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 46% of CVEs (scores of 2026-10-31)
CWE: CWE-732
Published: 2022-07-22
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

redhat:openstack

References

https://access.redhat.com/security/cve/cve-2022-1655
https://access.redhat.com/security/cve/cve-2022-1655

Check your stack JSON