CVE-2022-1655

{"id": "CVE-2022-1655", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "published": "2022-07-22T15:15:08.057", "references": [{"url": "https://access.redhat.com/security/cve/cve-2022-1655", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-732"}]}, {"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-732"}]}], "descriptions": [{"lang": "en", "value": "An Incorrect Permission Assignment for Critical Resource flaw was found in Horizon on Red Hat OpenStack. Horizon session cookies are created without the HttpOnly flag despite HorizonSecureCookies being set to true in the environmental files, possibly leading to a loss of confidentiality and integrity."}, {"lang": "es", "value": "Se ha encontrado un fallo de Asignaci\u00f3n Incorrecta de Permisos para Recursos Cr\u00edticos en Horizon en Red Hat OpenStack. Las cookies de sesi\u00f3n de Horizon son creadas sin el flag HttpOnly a pesar de que HorizonSecureCookies est\u00e1 configurado como true en los archivos de entorno, conllevando posiblemente a una p\u00e9rdida de confidencialidad e integridad"}], "lastModified": "2022-07-29T19:41:14.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:openstack:16.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "307846C3-F2B3-4E0D-AA31-BCC1444589F8"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}