CVE-2022-3100

A flaw was found in the openstack-barbican component. This issue allows an access policy bypass...

5.9 MediumFix available

A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: Low
Availability: None

Exploit likelihood

0.45%Down 0.4 points since Jan 19, 2023

What each source reports

NVD Score used 5.9

A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API.

Record: CVE-2022-3100
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
Weakness: CWE-305
Updated: 2026-11-02

CVE List 5.9

A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API.

Record: CVE-2022-3100
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
Weakness: CWE-305
Updated: 2026-11-02

EUVDEUVD-2022-42529 5.9

A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API.

Record: EUVD-2022-42529
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-5hg3-ffv7-g5ff 5.9

A flaw was found in the openstack-barbican component. This issue allows an access policy bypass...

A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API.

Record: GHSA-5hg3-ffv7-g5ff
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
Weakness: CWE-305
Updated: 2026-11-02

OSV 5.9

A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API.

Record: CVE-2022-3100
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
Weakness: CWE-305
Updated: 2026-11-02

OSVDEBIAN-CVE-2022-3100 5.9

A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API.

Record: DEBIAN-CVE-2022-3100
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
Updated: 2026-11-03

Show 5 moreShow less

OSVRHSA-2022:6750 7.1

Red Hat Security Advisory: Red Hat OpenStack Platform (openstack-barbican) security update

Record: RHSA-2022:6750
CVSS 3.1: 7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2022-3100 5.9

A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API.

Record: UBUNTU-CVE-2022-3100
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
Updated: 2026-11-02

OSVSUSE-SU-2023:0070-1 No score

Security update for openstack-barbican, openstack-heat-gbp, openstack-horizon-plugin-gbp-ui, openstack-neutron, openstack-neutron-gbp

This update for openstack-barbican, openstack-heat-gbp, openstack-horizon-plugin-gbp-ui, openstack-neutron, openstack-neutron-gbp fixes the following issues:

Security fixes included on this update:

openstack-barbican:

CVE-2022-3100: Fixed an access policy bypass via query string injection (bsc#1203873).

spark:

CVE-2022-33891: Fixed a command injection vulnerability via Spark UI (bsc#1204326).

Non Security fixes:

Changes in openstack-barbican:

Add patch to address access policy bypass via query string injection. (bsc#1203873, CVE-2022-3100.)

Changes in openstack-heat-gbp:

Update to version group-based-policy-automation-14.0.1.dev5:
- Add support for zed

Changes in openstack-horizon-plugin-gbp-ui:

Update to version group-based-policy-ui-14.0.1.dev6:
- Add support for zed
Update to version group-based-policy-ui-14.0.1.dev5:
- fix launch instance GBP issue

Changes in openstack-neutron:

Update to version neutron-13.0.8.dev209:
- Update documentation link for openSUSE index
Update to version neutron-13.0.8.dev208:
- fix: Fix url of Floodlight
Update to version neutron-13.0.8.dev207:
- Mellanox_eth.img url expires, remove the mellanox_eth.img node

Changes in openstack-neutron:

Update to version neutron-13.0.8.dev209:
- Update documentation link for openSUSE index
Update to version neutron-13.0.8.dev208:
- fix: Fix url of Floodlight
Update to version neutron-13.0.8.dev207:
- Mellanox_eth.img url expires, remove the mellanox_eth.img node

Changes in openstack-neutron-gbp:

Update to version group-based-policy-14.0.1.dev52:
- Fix keystone notification listener
Update to version group-based-policy-14.0.1.dev51:
- Support for epg subnet 2014.2.0rc1
Update to version group-based-policy-14.0.1.dev50:
- Use top-level contract references 2014.2.rc1
Update to version group-based-policy-14.0.1.dev48:
- Remove py37 jobs from gate 2014.2rc1

Changes in spark:

Avoid using bash -c in ShellBasedGroupsMappingProvider. (bsc#1204326, CVE-2022-33891)
Add _constraints to prevent build from running out of disk space
Update to version group-based-policy-14.0.1.dev47:
- Remove python39 from voting

Record: SUSE-SU-2023:0070-1
Updated: 2026-11-02

OSVSUSE-SU-2023:0071-1 No score

Security update for openstack-barbican

This update for openstack-barbican contains the following fix:

Security fix included on this update: openstack-barbican:

CVE-2022-3100: Fixed an access policy bypass via query string injection (bsc#1203873).

Update for openstack-barbican:

Add patch for CVE-2022-3100 to address access policy bypass via query string injection. (bsc#1203873, CVE-2022-3100)

Record: SUSE-SU-2023:0071-1
Updated: 2026-11-02

OSVUSN-5697-1 No score

barbican vulnerability

Douglas Mendizabal discovered that Barbican incorrectly handled certain query strings. A remote attacker could possibly use this issue to bypass the access policy.

Record: USN-5697-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`barbican` Debian:12	before 1:15.0.0~rc3-1	1:15.0.0~rc3-1
`barbican` Debian:13	before 1:15.0.0~rc3-1	1:15.0.0~rc3-1
`barbican` Debian:14	before 1:15.0.0~rc3-1	1:15.0.0~rc3-1
`barbican` Debian:10	before 1:7.0.0-1+deb10u1, plus listed versions 1:7.0.0-1	1:7.0.0-1+deb10u1
`barbican` Debian:11	before 1:11.0.0-3+deb11u1, plus listed versions 1:11.0.0-3	1:11.0.0-3+deb11u1
`openstack-barbican` Red Hat:openstack:13::el7	before 0:6.0.1-6.el7ost	0:6.0.1-6.el7ost
`openstack-barbican-api` Red Hat:openstack:13::el7	before 0:6.0.1-6.el7ost	0:6.0.1-6.el7ost
`openstack-barbican-common` Red Hat:openstack:13::el7	before 0:6.0.1-6.el7ost	0:6.0.1-6.el7ost
`openstack-barbican` Red Hat:openstack:16.1::el8	before 0:9.0.1-1.20220112203416.07be198.el8ost	0:9.0.1-1.20220112203416.07be198.el8ost
`openstack-barbican-api` Red Hat:openstack:16.1::el8	before 0:9.0.1-1.20220112203416.07be198.el8ost	0:9.0.1-1.20220112203416.07be198.el8ost

Show 38 moreShow less

Affected packages
Package	Affected	Fixed
`openstack-barbican-common` Red Hat:openstack:16.1::el8	before 0:9.0.1-1.20220112203416.07be198.el8ost	0:9.0.1-1.20220112203416.07be198.el8ost
`python3-barbican` Red Hat:openstack:16.1::el8	before 0:9.0.1-1.20220112203416.07be198.el8ost	0:9.0.1-1.20220112203416.07be198.el8ost
`openstack-barbican` Red Hat:openstack:16.2::el8	before 0:9.0.2-2.20220122185349.c718783.el8ost	0:9.0.2-2.20220122185349.c718783.el8ost
`openstack-barbican-api` Red Hat:openstack:16.2::el8	before 0:9.0.2-2.20220122185349.c718783.el8ost	0:9.0.2-2.20220122185349.c718783.el8ost
`openstack-barbican-common` Red Hat:openstack:16.2::el8	before 0:9.0.2-2.20220122185349.c718783.el8ost	0:9.0.2-2.20220122185349.c718783.el8ost
`python3-barbican` Red Hat:openstack:16.2::el8	before 0:9.0.2-2.20220122185349.c718783.el8ost	0:9.0.2-2.20220122185349.c718783.el8ost
`openstack-barbican` Red Hat:openstack:17.0::el9	before 0:12.0.1-0.20220614210405.486e607.el9ost	0:12.0.1-0.20220614210405.486e607.el9ost
`openstack-barbican-api` Red Hat:openstack:17.0::el9	before 0:12.0.1-0.20220614210405.486e607.el9ost	0:12.0.1-0.20220614210405.486e607.el9ost
`openstack-barbican-common` Red Hat:openstack:17.0::el9	before 0:12.0.1-0.20220614210405.486e607.el9ost	0:12.0.1-0.20220614210405.486e607.el9ost
`python3-barbican` Red Hat:openstack:17.0::el9	before 0:12.0.1-0.20220614210405.486e607.el9ost	0:12.0.1-0.20220614210405.486e607.el9ost
`openstack-barbican` SUSE:OpenStack Cloud 9 From an advisory covering 2 CVEs	before 7.0.1~dev24-3.17.1	7.0.1~dev24-3.17.1
`openstack-heat-gbp` SUSE:OpenStack Cloud 9 From an advisory covering 2 CVEs	before 14.0.1~dev5-3.12.1	14.0.1~dev5-3.12.1
`openstack-horizon-plugin-gbp-ui` SUSE:OpenStack Cloud 9 From an advisory covering 2 CVEs	before 14.0.1~dev6-3.15.1	14.0.1~dev6-3.15.1
`openstack-neutron` SUSE:OpenStack Cloud 9 From an advisory covering 2 CVEs	before 13.0.8~dev209-3.43.1	13.0.8~dev209-3.43.1
`openstack-neutron-gbp` SUSE:OpenStack Cloud 9 From an advisory covering 2 CVEs	before 14.0.1~dev52-3.37.1	14.0.1~dev52-3.37.1
`spark` SUSE:OpenStack Cloud 9 From an advisory covering 2 CVEs	before 2.2.3-5.12.1	2.2.3-5.12.1
`venv-openstack-barbican` SUSE:OpenStack Cloud 9 From an advisory covering 2 CVEs	before 7.0.1~dev24-3.37.1	7.0.1~dev24-3.37.1
`venv-openstack-horizon` SUSE:OpenStack Cloud 9 From an advisory covering 2 CVEs	before 14.1.1~dev11-4.43.1	14.1.1~dev11-4.43.1
`venv-openstack-neutron` SUSE:OpenStack Cloud 9 From an advisory covering 2 CVEs	before 13.0.8~dev209-6.43.1	13.0.8~dev209-6.43.1
`venv-openstack-nova` SUSE:OpenStack Cloud 9 From an advisory covering 2 CVEs	before 18.3.1~dev92-3.43.1	18.3.1~dev92-3.43.1
`openstack-barbican` SUSE:OpenStack Cloud Crowbar 9 From an advisory covering 2 CVEs	before 7.0.1~dev24-3.17.1	7.0.1~dev24-3.17.1
`openstack-heat-gbp` SUSE:OpenStack Cloud Crowbar 9 From an advisory covering 2 CVEs	before 14.0.1~dev5-3.12.1	14.0.1~dev5-3.12.1
`openstack-horizon-plugin-gbp-ui` SUSE:OpenStack Cloud Crowbar 9 From an advisory covering 2 CVEs	before 14.0.1~dev6-3.15.1	14.0.1~dev6-3.15.1
`openstack-neutron` SUSE:OpenStack Cloud Crowbar 9 From an advisory covering 2 CVEs	before 13.0.8~dev209-3.43.1	13.0.8~dev209-3.43.1
`openstack-neutron-gbp` SUSE:OpenStack Cloud Crowbar 9 From an advisory covering 2 CVEs	before 14.0.1~dev52-3.37.1	14.0.1~dev52-3.37.1
`spark` SUSE:OpenStack Cloud Crowbar 9 From an advisory covering 2 CVEs	before 2.2.3-5.12.1	2.2.3-5.12.1
`openstack-barbican` SUSE:HPE Helion OpenStack 8	before 5.0.2~dev3-3.17.2	5.0.2~dev3-3.17.2
`openstack-barbican-doc` SUSE:HPE Helion OpenStack 8	before 5.0.2~dev3-3.17.2	5.0.2~dev3-3.17.2
`venv-openstack-barbican` SUSE:HPE Helion OpenStack 8	before 5.0.2~dev3-12.43.2	5.0.2~dev3-12.43.2
`openstack-barbican` SUSE:OpenStack Cloud 8	before 5.0.2~dev3-3.17.2	5.0.2~dev3-3.17.2
`openstack-barbican-doc` SUSE:OpenStack Cloud 8	before 5.0.2~dev3-3.17.2	5.0.2~dev3-3.17.2
`venv-openstack-barbican` SUSE:OpenStack Cloud 8	before 5.0.2~dev3-12.43.2	5.0.2~dev3-12.43.2
`openstack-barbican` SUSE:OpenStack Cloud Crowbar 8	before 5.0.2~dev3-3.17.2	5.0.2~dev3-3.17.2
`openstack-barbican-doc` SUSE:OpenStack Cloud Crowbar 8	before 5.0.2~dev3-3.17.2	5.0.2~dev3-3.17.2
`barbican` Ubuntu:16.04:LTS	All versions, plus listed versions 1:1.0.0-0ubuntu11:2.0.0~b1-0ubuntu11:2.0.0~b2-0ubuntu11:2.0.0~b2-0ubuntu21:2.0.0~b2-0ubuntu3 Show 4 moreShow less 1:2.0.0~b3-0ubuntu11:2.0.0~rc1-0ubuntu11:2.0.0-0ubuntu11:2.0.0-0ubuntu1.1	None known
`barbican` Ubuntu:18.04:LTS	before 1:6.0.1-0ubuntu1.2, plus listed versions 1:5.0.0-0ubuntu11:6.0.0~b1-0ubuntu11:6.0.0~b1-0ubuntu21:6.0.0~b2-0ubuntu11:6.0.0~b3-0ubuntu1 Show 4 moreShow less 1:6.0.0~rc1-0ubuntu11:6.0.0-0ubuntu11:6.0.1-0ubuntu11:6.0.1-0ubuntu1.1	1:6.0.1-0ubuntu1.2
`barbican` Ubuntu:20.04:LTS	before 1:10.1.0-0ubuntu2.2, plus listed versions 1:9.0.0-0ubuntu11:10.0.0~b2~git2020020508.7b14d983-0ubuntu11:10.0.0~b2~git2020020508.7b14d983-0ubuntu21:10.0.0~b2~git2020020508.7b14d983-0ubuntu31:10.0.0-0ubuntu0.20.04.1 Show 4 moreShow less 1:10.0.0-0ubuntu0.20.04.31:10.1.0-0ubuntu11:10.1.0-0ubuntu21:10.1.0-0ubuntu2.1	1:10.1.0-0ubuntu2.2
`barbican` Ubuntu:22.04:LTS	before 2:14.0.0-0ubuntu1.1, plus listed versions 2:13.0.0-0ubuntu12:13.0.0-0ubuntu22:13.0.0+git2022011215.a9d2b133-0ubuntu12:13.0.0+git2022011215.a9d2b133-0ubuntu22:13.0.0+git2022030310.ffea7f79-0ubuntu12:14.0.0-0ubuntu1	2:14.0.0-0ubuntu1.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-3100 is a medium vulnerability (CVSS 5.9) in Openstack Barbican, published September 29, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.45%, the 39th percentile. Fixed in barbican 1:15.0.0~rc3-1.

References

Show 12 moreShow less