CVE-2022-0670

Advisory lineage Upstream: 0 Downstream: 9
Modified
Published: 25 Jul 2022, 13:58
Last modified:02 Aug 2024, 23:32

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.1 CRITICAL
v3.1 (nvd)
EPSS Score
0.22% LOW
0% probability +0.03%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

25 Jul 2022, 13:58
Published
Vulnerability first disclosed
02 Aug 2024, 23:32
Last Modified
Vulnerability information updated

Description

A flaw was found in Openstack manilla owning a Ceph File system "share", which enables the owner to read/write any manilla share or entire file system. The vulnerability is due to a bug in the "volumes" plugin in Ceph Manager. This allows an attacker to compromise Confidentiality and Integrity of a file system. Fixed in RHCS 5.2 and Ceph 17.2.2.

CVSS Metrics

  • v3.1•CRITICAL•Score: 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS Trends

Current EPSS score: 0.22%• Percentile: 45%

Techniques & Countermeasures

  • CWE-863•Incorrect Authorization

    The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Affected Systems

  • fedoraproject•fedora

    35 | 36

  • linuxfoundation•ceph

    ≥ 15.0.0, < 15.2.17 | ≥ 16.0.0, < 16.2.10 | ≥ 17.0.0, < 17.2.2

  • redhat•ceph_storage

    < 5.2

References (3)