CVE-2022-1655 Security feature bypass in OpenStack

What is CVE-2022-1655?

CVE-2022-1655 is a medium-severity vulnerability in Redhat Openstack, published on 22 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An Incorrect Permission Assignment for Critical Resource flaw was found in Horizon on Red Hat OpenStack. Horizon session cookies are created without the HttpOnly flag despite HorizonSecureCookies being set to true in the environmental files, possibly leading to a loss of confidentiality and integrity.

Weakness: CWE-732

Which versions are affected by CVE-2022-1655?

It affects 1 product.

Products include Redhat Openstack.

How do I fix CVE-2022-1655?

Apply the vendor's patch.

Is CVE-2022-1655 being exploited?

There is no known exploitation of CVE-2022-1655 in the wild and no public exploit code.

Other vulnerabilities in Redhat Openstack

• CVE-2015-1842 Hardcoded credentials in n/a Critical 10.0
• CVE-2017-2637 Auth bypass in rhosp-director Critical 9.9
• CVE-2022-38065 Privilege escalation in OpenStack High 8.8
• CVE-2016-4474 Hardcoded credentials in n/a High 8.8
• CVE-2021-31918 Information disclosure in tripleo-ansible High 7.5

All Redhat Openstack vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xm48-7qq2-36x4, RHSA-2022:8856.