MEDIUM🇵🇱 Wersja polska

CVE-2022-2447

CVSS 6.6v3.1pub. 2022-09-01upd. 2024-11-21

A flaw was found in Keystone. There is a time lag (up to one hour in a default configuration) between when security policy says a token should be revoked from when it is actually revoked. This could allow a remote administrator to secretly maintain access for longer than expected.

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

  • Openstack Keystone

    APP
    Openstack
    all versions

  • Red Hat Openstack

    APP
    Redhat
    16.116.2

  • Red Hat Openstack Platform

    APP
    Redhat
    16.116.2

  • Red Hat Quay

    APP
    Redhat
    3.0.0

  • Red Hat Storage

    APP
    Redhat
    3.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2012-1823CRITICAL9.8⚠ KEVPL ✓same product

RCE w PHP-CGI poprzez wstrzyknięcie opcji wiersza poleceń

CVE-2023-3961CRITICAL9.1PL ✓same product

Path traversal w Samba — nieautoryzowany dostęp przez Unix domain socket

CVE-2022-26148CRITICAL9.8PL ✓same product

Ujawnienie hasła Zabbix w kodzie źródłowym HTML w Grafana

CVE-2021-3762CRITICAL9.8PL ✓same product

Path Traversal w ClairCore umożliwiający zapis plików i RCE

CVE-2020-27832CRITICAL9.0PL ✓same product

Persistent XSS w Red Hat Quay – powiadomienia repozytoriów