CVE-2022-1655
An Incorrect Permission Assignment for Critical Resource flaw was found in Horizon on Red Hat...
An Incorrect Permission Assignment for Critical Resource flaw was found in Horizon on Red Hat OpenStack. Horizon session cookies are created without the HttpOnly flag despite HorizonSecureCookies being set to true in the environmental files, possibly leading to a loss of confidentiality and integrity.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
An Incorrect Permission Assignment for Critical Resource flaw was found in Horizon on Red Hat OpenStack. Horizon session cookies are created without the HttpOnly flag despite HorizonSecureCookies being set to true in the environmental files, possibly leading to a loss of confidentiality and integrity.
- Record
CVE-2022-1655- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-732
- Updated
- 2026-11-02
CVE List No score
An Incorrect Permission Assignment for Critical Resource flaw was found in Horizon on Red Hat OpenStack. Horizon session cookies are created without the HttpOnly flag despite HorizonSecureCookies being set to true in the environmental files, possibly leading to a loss of confidentiality and integrity.
- Record
CVE-2022-1655- Weakness
- CWE-732
- Updated
- 2026-11-02
EUVDEUVD-2022-24941 No score
An Incorrect Permission Assignment for Critical Resource flaw was found in Horizon on Red Hat OpenStack. Horizon session cookies are created without the HttpOnly flag despite HorizonSecureCookies being set to true in the environmental files, possibly leading to a loss of confidentiality and integrity.
- Record
EUVD-2022-24941- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xm48-7qq2-36x4
An Incorrect Permission Assignment for Critical Resource flaw was found in Horizon on Red Hat...
An Incorrect Permission Assignment for Critical Resource flaw was found in Horizon on Red Hat OpenStack. Horizon session cookies are created without the HttpOnly flag despite HorizonSecureCookies being set to true in the environmental files, possibly leading to a loss of confidentiality and integrity.
- Record
GHSA-xm48-7qq2-36x4- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-732
- Updated
- 2026-11-02
OSVRHSA-2022:8856
Red Hat Security Advisory: Red Hat OpenStack Platform 16.2.4 (python-django-horizon) security update
- Record
RHSA-2022:8856- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
python-django-horizonRed Hat:openstack:16.2::el8 |
before 1:16.2.3-2.20220926144724.d3d3d18.el8ost | 1:16.2.3-2.20220926144724.d3d3d18.el8ost |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-1655 is a medium vulnerability (CVSS 6.5) in Redhat Openstack, published July 22, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.55%, the 46th percentile. Fixed in python-django-horizon 1:16.2.3-2.20220926144724.d3d3d18.el8ost.
References
access.redhat.com/security/cve/cve-2022-1655
nvd.nist.gov/vuln/detail/CVE-2022-1655
github.com/advisories/GHSA-xm48-7qq2-36x4
bugzilla.redhat.com/show_bug.cgi?id=1931593