5.7

CVE-2022-47951: debian debian_linux Path Traversal

CVSS: 5.7v3.1MediumModified
AliasesSUSE-SU-2023:0844-1SUSE-SU-2023:1949-1GHSA-7h75-hwxx-qpgc
Published 26-01-2023Last modified 31-03-2025
Open JSON

Vulnerability summary

CVE-2022-47951 is a medium (CVSS 5.7) Path Traversal vulnerability in debian debian_linux. EPSS estimates a 1.03% chance of exploitation in the next 30 days, higher than 63.2% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
33/100
0100
Medium · default modelHow is this calculated?
CVSS score
5.7/10
010
Medium · v3.1 (CVE.org)
EPSS score
1.03%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
USN-6882-2

Timeline

  1. 26-01-2023
    PublishedVulnerability first disclosed.
  2. 31-03-2025
    Last modifiedVulnerability information updated.

Description

An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data.

CVSS metrics

6 scores · 6 sources · 1 version

EPSS trend

Probability

1.03%

Chance of exploitation in the next 30 days

Percentile

63%

Versus all other CVEs

30-day change

0.00 pp

From 1.03% on 19-09-2026

19-09-202619-10-2026
EPSS score
1.03%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (launchpad.net)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Suse86 products
  • openstack-cinder-doc&distro=HPE Helion OpenStack 8< 11.2.3~dev29-3.31.1
  • openstack-cinder-doc&distro=SUSE OpenStack Cloud 8< 11.2.3~dev29-3.31.1
  • openstack-cinder-doc&distro=SUSE OpenStack Cloud Crowbar 8< 11.2.3~dev29-3.31.1
  • openstack-cinder&distro=HPE Helion OpenStack 8< 11.2.3~dev29-3.31.2
  • openstack-cinder&distro=SUSE OpenStack Cloud 8< 11.2.3~dev29-3.31.2
Redhat25 products
  • openstack-cinder< 1:18.2.1-0.20230202190311.1776695.el9ost | < 1:12.0.10-27.el7ost | < 1:15.4.0-1.20230206163350.58f0e73.el8ost | < 1:15.6.1-2.20221003154726.87578a0.el8ost
  • openstack-glance< 1:22.1.1-0.20220919210603.677c89c.el9ost | < 1:16.0.1-13.el7ost | < 1:19.0.4-1.20230207203320.5bbd356.el8ost | < 1:19.0.5-2.20220113204850.b3de9da.el8ost
  • openstack-nova< 1:23.2.2-0.20221209190753.7074ac0.el9ost | < 1:17.0.13-40.el7ost | < 1:20.4.1-1.20221005193231.1ee93b9.el8ost | < 1:20.6.2-2.20221005185231.6786e96.el8ost
  • openstack-nova-api< 1:23.2.2-0.20221209190753.7074ac0.el9ost | < 1:17.0.13-40.el7ost | < 1:20.4.1-1.20221005193231.1ee93b9.el8ost | < 1:20.6.2-2.20221005185231.6786e96.el8ost
  • openstack-nova-cells< 1:17.0.13-40.el7ost
Debian4 products
  • cinder< 2:17.0.1-1+deb11u1 | < 2:13.0.7-1+deb10u2 | < 2:21.0.0-3
  • glance< 2:21.0.0-2+deb11u1 | < 2:17.0.0-5+deb10u1 | < 2:25.0.0-2
  • nova< 2:22.0.1-2+deb11u1 | < 2:18.1.0-6+deb10u2 | < 2:26.0.0-6
  • debian_linuxEOL10.0 | 11.0
Openstack3 products
  • cinder≤ 19.1.2 | ≥ 20.0.0, < 20.0.2
  • glance< 23.0.1 | ≥ 24.0.0, < 24.1.1
  • nova< 24.1.2 | ≥ 25.0.0, < 25.0.2
PyPI3 products
  • cinder< 19.1.2 | ≥ 20.0.0, < 20.0.2
  • glance< 23.0.1 | ≥ 24.0.0, < 24.1.1
  • nova< 24.1.2 | ≥ 25.0.0, < 25.0.2
Ubuntu3 products
  • cinderAll versions (No fix recorded) | < 2:16.4.2-0ubuntu2.1 | < 2:20.1.0-0ubuntu1 | < 2:12.0.10-0ubuntu2.2 | < 2:16.4.2-0ubuntu2.2
  • glance< 2:20.2.0-0ubuntu1.1 | < 2:24.1.0-0ubuntu1.1
  • novaAll versions (No fix recorded) | < 2:21.2.4-0ubuntu2.1 | < 3:25.1.0-0ubuntu1 | < 2:17.0.13-0ubuntu5.2

6 vendors · 124 products

References

41 links
Show all 41 references