CVSS 3.1
5.7 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:NCVE-2022-47951
An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data.
Severity
- EPSS
- 1.0% chance of exploitation in the next 30 days; higher than 63% of CVEs (scores of 2026-10-31)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- openstack:cinder
- openstack:glance
- openstack:nova
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-7h75-hwxx-qpgc | PyPI | cinder | <19.1.2 | 19.1.2 |
| GHSA-7h75-hwxx-qpgc | PyPI | cinder | >=20.0.0 <20.0.2 | 20.0.2 |
| GHSA-7h75-hwxx-qpgc | PyPI | glance | <23.0.1 | 23.0.1 |
| GHSA-7h75-hwxx-qpgc | PyPI | glance | >=24.0.0 <24.1.1 | 24.1.1 |
| GHSA-7h75-hwxx-qpgc | PyPI | nova | <24.1.2 | 24.1.2 |
| GHSA-7h75-hwxx-qpgc | PyPI | nova | >=25.0.0 <25.0.2 | 25.0.2 |
| PYSEC-2026-2411 | PyPI | cinder | <19.1.2 >=20.0.0 <20.0.2 | 19.1.2, 20.0.2 |
| PYSEC-2026-2490 | PyPI | glance | <23.0.1 >=24.0.0 <24.1.1 | 23.0.1, 24.1.1 |
| PYSEC-2026-868 | PyPI | nova | <24.1.2 >=25.0.0 <25.0.2 | 24.1.2, 25.0.2 |