CVE-2022-3261
Plain-text passwords saved in /var/log/messages
A flaw was found in OpenStack. Multiple components show plain-text passwords in /var/log/messages during the OpenStack overcloud update run, leading to a disclosure of sensitive information problem.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Plain-text passwords saved in /var/log/messages
A flaw was found in OpenStack. Multiple components show plain-text passwords in /var/log/messages during the OpenStack overcloud update run, leading to a disclosure of sensitive information problem.
- Record
CVE-2022-3261- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-256
- Updated
- 2026-11-02
EUVDEUVD-2022-42663
A flaw was found in OpenStack. Multiple components show plain-text passwords in /var/log/messages during the OpenStack overcloud update run, leading to a disclosure of sensitive information problem.
- Record
EUVD-2022-42663- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-95f8-wgwf-v4mc
A flaw was found in OpenStack. Multiple components show plain-text passwords in /var/log/messages...
A flaw was found in OpenStack. Multiple components show plain-text passwords in /var/log/messages during the OpenStack overcloud update run, leading to a disclosure of sensitive information problem.
- Record
GHSA-95f8-wgwf-v4mc- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-256, CWE-319
- Updated
- 2026-11-02
NVD
A flaw was found in OpenStack. Multiple components show plain-text passwords in /var/log/messages during the OpenStack overcloud update run, leading to a disclosure of sensitive information problem.
- Record
CVE-2022-3261- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-256, CWE-319
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-3261
A flaw was found in OpenStack. Multiple components show plain-text passwords in /var/log/messages during the OpenStack overcloud update run, leading to a disclosure of sensitive information problem.
- Record
UBUNTU-CVE-2022-3261- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openstackUbuntu:16.04:LTS |
All versions, plus listed versions 0.99.230.99.271.0.41.0.51.0.61.0.7.16.04.1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-3261 is a medium vulnerability (CVSS 4.4) in Red Hat Openstack Platform 16.2, published September 15, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 21st percentile. No source names a fixed version.