{"id":"CVE-2022-3287","aliases":["ALSA-2023:2487","ALSA-2023:7189","DEBIAN-CVE-2022-3287","EUVD-2022-42683","GHSA-7qqr-wwjq-98v6","RHSA-2023:2487","RHSA-2023:7189","RHSA-2024:1106","RHSA-2024:1403","RLSA-2023:7189","UBUNTU-CVE-2022-3287","openSUSE-SU-2024:12438-1"],"status":"published","title":"When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated...","description":"When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same configuration file.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00827,"percentile":0.57723,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-256","CWE-552"],"published":"2022-09-28T19:07:38Z","modified":"2026-11-03T08:01:21Z","fixes":[{"ecosystem":"AlmaLinux:8","package":"fwupd","fixed_in":["1.7.8-2.el8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"fwupd-devel","fixed_in":["1.7.8-2.el8"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"fwupd","fixed_in":["1.8.5-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"fwupd","fixed_in":["1.8.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"fwupd","fixed_in":["1.8.5-1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"fwupd","fixed_in":["0:1.7.8-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"fwupd-debuginfo","fixed_in":["0:1.7.8-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"fwupd-debugsource","fixed_in":["0:1.7.8-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"fwupd-tests-debuginfo","fixed_in":["0:1.7.8-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"fwupd-debuginfo","fixed_in":["0:1.7.8-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"fwupd-debugsource","fixed_in":["0:1.7.8-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"fwupd-devel","fixed_in":["0:1.7.8-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"fwupd-tests-debuginfo","fixed_in":["0:1.7.8-2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"fwupd","fixed_in":["0:1.7.4-3.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"fwupd-debuginfo","fixed_in":["0:1.7.4-3.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"fwupd-debugsource","fixed_in":["0:1.7.4-3.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"fwupd-tests-debuginfo","fixed_in":["0:1.7.4-3.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::crb","package":"fwupd-debuginfo","fixed_in":["0:1.7.4-3.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::crb","package":"fwupd-debugsource","fixed_in":["0:1.7.4-3.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::crb","package":"fwupd-devel","fixed_in":["0:1.7.4-3.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::crb","package":"fwupd-tests-debuginfo","fixed_in":["0:1.7.4-3.el8_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"fwupd","fixed_in":["0:1.7.8-2.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"fwupd-debuginfo","fixed_in":["0:1.7.8-2.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"fwupd-debugsource","fixed_in":["0:1.7.8-2.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"fwupd-tests-debuginfo","fixed_in":["0:1.7.8-2.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::crb","package":"fwupd-debuginfo","fixed_in":["0:1.7.8-2.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::crb","package":"fwupd-debugsource","fixed_in":["0:1.7.8-2.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::crb","package":"fwupd-devel","fixed_in":["0:1.7.8-2.el8_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::crb","package":"fwupd-tests-debuginfo","fixed_in":["0:1.7.8-2.el8_8"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"fwupd","fixed_in":["0:1.7.8-2.el8.rocky.0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"fwupd","fixed_in":["1.8.6-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"fwupd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.10-2.el9.alma"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"fwupd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.10-2.el9.alma"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"fwupd-plugin-flashrom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.10-2.el9.alma"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"fwupd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.8-2.el8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"fwupd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.8-2.el8"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"fwupd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"fwupd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"fwupd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.5-1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"fwupd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.10-2.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"fwupd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.10-2.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"fwupd-plugin-flashrom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.10-2.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"fwupd-plugin-flashrom-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.10-2.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"fwupd-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.10-2.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"fwupd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.10-2.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"fwupd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.10-2.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"fwupd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.10-2.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"fwupd-plugin-flashrom-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.10-2.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"fwupd-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.10-2.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"fwupd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.10-2.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"fwupd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.10-2.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"fwupd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.10-2.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"fwupd-plugin-flashrom-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.10-2.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"fwupd-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.10-2.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"fwupd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.8-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"fwupd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.8-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"fwupd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.8-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"fwupd-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.8-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"fwupd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.8-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"fwupd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.8-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"fwupd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.8-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"fwupd-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.8-2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"fwupd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.4-3.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"fwupd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.4-3.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"fwupd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.4-3.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::baseos","package":"fwupd-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.4-3.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::crb","package":"fwupd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.4-3.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::crb","package":"fwupd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.4-3.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::crb","package":"fwupd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.4-3.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::crb","package":"fwupd-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.4-3.el8_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"fwupd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.8-2.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"fwupd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.8-2.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"fwupd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.8-2.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::baseos","package":"fwupd-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.8-2.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::crb","package":"fwupd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.8-2.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::crb","package":"fwupd-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.8-2.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::crb","package":"fwupd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.8-2.el8_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::crb","package":"fwupd-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.8-2.el8_8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"fwupd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.8-2.el8.rocky.0.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"fwupd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.10-1ubuntu2","1.3.3-3","1.3.5-1","1.3.6-1ubuntu1","1.3.7-2","1.3.7-3","1.3.8-1","1.3.9-1","1.3.9-1build1","1.3.9-2","1.3.9-2build1","1.3.9-3","1.3.9-4","1.3.9-4ubuntu0.1","1.3.11-1~focal1","1.5.11-0ubuntu1~20.04.2","1.7.5-3~20.04.1","1.7.9-1~20.04.1","1.7.9-1~20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"fwupd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.11-0ubuntu2","1.7.1-1ubuntu3","1.7.3-1","1.7.4-1","1.7.4-1ubuntu1","1.7.5-3","1.7.9-1~22.04.1","1.7.9-1~22.04.3","2.0.20-1ubuntu2~22.04.1","2.0.20-1ubuntu2~22.04.2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"fwupd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.6-1.1"}]}]}],"products":[{"vendor":"fwupd","product":"fwupd"}],"references":[{"url":"https://github.com/fwupd/fwupd/commit/ea676855f2119e36d433fbd2ed604039f53b2091","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3287","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7qqr-wwjq-98v6"},{"url":"https://access.redhat.com/errata/RHSA-2023:2487","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-3287","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-34301","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-34302","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-34303","tags":["report"]},{"url":"https://bugzilla.redhat.com/2120687","tags":["report"]},{"url":"https://bugzilla.redhat.com/2120699","tags":["report"]},{"url":"https://bugzilla.redhat.com/2120701","tags":["report"]},{"url":"https://bugzilla.redhat.com/2129904","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-2487.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:7189","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-7189.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/3xxx/CVE-2022-3287.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-3287","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.2_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2119436","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2120687","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2120699","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2120701","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2128384","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2129280","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2129904","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2165096","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2487.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-3287","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-34301","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-34301","tags":["advisory"]},{"url":"https://eclypsium.com/2022/08/11/vulnerable-bootloaders-2022/","tags":["article"]},{"url":"https://kb.cert.org/vuls/id/309662","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-34302","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-34302","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-34303","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-34303","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.9_release_notes/index","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7189.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1106","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1106.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1403","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1403.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:7189","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-3287","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-3287","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-3287","description":"When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same configuration file.","status":"published","published":"2022-09-28T19:07:38Z","modified":"2025-05-20T20:12:47.373Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-256"],"updated_at":"2026-11-02T14:34:33.24035Z"}],"euvd":[{"id":"EUVD-2022-42683","description":"When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same configuration file.","status":"published","published":"2022-09-28T19:07:38Z","modified":"2025-05-20T20:12:47Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:41.963587Z"}],"ghsa":[{"id":"GHSA-7qqr-wwjq-98v6","title":"When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated...","description":"When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same configuration file.","status":"published","published":"2022-09-29T00:00:20Z","modified":"2025-05-20T21:30:26Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-256","CWE-552"],"updated_at":"2026-11-02T15:02:23.05875Z"}],"nvd":[{"id":"CVE-2022-3287","description":"When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same configuration file.","status":"published","published":"2022-09-28T20:15:18.433Z","modified":"2026-06-17T04:59:14.02Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-256","CWE-552"],"updated_at":"2026-11-02T14:07:29.026521Z"}],"osv":[{"id":"CVE-2022-3287","description":"When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same configuration file.","status":"published","published":"2022-09-28T19:07:38Z","modified":"2026-10-28T10:26:57.707105097Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-256"],"updated_at":"2026-11-02T15:44:25.860945Z"},{"id":"DEBIAN-CVE-2022-3287","description":"When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same configuration file.","status":"published","published":"2022-09-28T20:15:18.433Z","modified":"2026-11-03T08:01:21.746060064Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T08:25:01.007408Z"},{"id":"RHSA-2023:2487","title":"Red Hat Security Advisory: fwupd security and bug fix update","status":"published","published":"2024-09-16T09:23:05Z","modified":"2026-06-27T10:16:59Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:10.611604Z"},{"id":"RHSA-2023:7189","title":"Red Hat Security Advisory: fwupd security update","status":"published","published":"2024-09-16T09:23:16Z","modified":"2026-06-27T10:18:48Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:11.734882Z"},{"id":"RHSA-2024:1106","title":"Red Hat Security Advisory: fwupd security update","status":"published","published":"2024-09-16T09:23:27Z","modified":"2026-06-27T10:19:14Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:1403","title":"Red Hat Security Advisory: fwupd security update","status":"published","published":"2024-09-16T09:23:36Z","modified":"2026-06-27T10:19:16Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"UBUNTU-CVE-2022-3287","description":"When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same configuration file.","status":"published","published":"2022-09-28T20:15:00Z","modified":"2026-07-10T02:20:04.402977625Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:53:54.697021Z"},{"id":"ALSA-2023:2487","title":"Moderate: fwupd security and bug fix update","description":"The fwupd packages provide a service that allows session software to update device firmware.\n\nSecurity Fix(es):\n\n* fwupd: world readable password in /etc/fwupd/redfish.conf (CVE-2022-3287)\n* shim: 3rd party shim allow secure boot bypass (CVE-2022-34301)\n* shim: 3rd party shim allow secure boot bypass (CVE-2022-34302)\n* shim: 3rd party shim allow secure boot bypass (CVE-2022-34303)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2023-05-09T00:00:00Z","modified":"2026-10-29T11:30:56.414740871Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"ALSA-2023:7189","title":"Moderate: fwupd security update","description":"The fwupd packages provide a service that allows session software to update device firmware.\n\nSecurity Fix(es):\n\n* fwupd: world readable password in /etc/fwupd/redfish.conf (CVE-2022-3287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2023-11-14T00:00:00Z","modified":"2026-10-29T11:02:12.252061639Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"openSUSE-SU-2024:12438-1","title":"dfu-tool-1.8.6-1.1 on GA media","description":"These are all security issues fixed in the dfu-tool-1.8.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:27:43.07257Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"RLSA-2023:7189","title":"Moderate: fwupd security update","description":"The fwupd packages provide a service that allows session software to update device firmware.\n\nSecurity Fix(es):\n\n* fwupd: world readable password in /etc/fwupd/redfish.conf (CVE-2022-3287)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.9 Release Notes linked from the References section.","status":"published","published":"2023-11-28T22:42:52.397971Z","modified":"2026-02-05T13:45:16.675615Z","updated_at":"2026-11-02T15:53:24.63379Z"}]}}