{"id":"CVE-2022-3596","aliases":["EUVD-2022-42960","GHSA-788f-3f4f-vv6f","RHSA-2022:8897"],"status":"published","title":"Instack-undercloud: rsync leaks information to undercloud","description":"An information leak was found in OpenStack's undercloud. This flaw allows unauthenticated, remote attackers to inspect sensitive data after discovering the IP address of the undercloud, possibly leading to compromising private information, including administrator access credentials.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01107,"percentile":0.6608,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-402"],"published":"2023-09-20T19:06:28Z","modified":"2026-06-29T10:44:52Z","fixes":[{"ecosystem":"Red Hat:openstack:13::el7","package":"instack-undercloud","fixed_in":["0:8.4.9-13.el7ost"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Red Hat:openstack:13::el7","package":"instack-undercloud","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.4.9-13.el7ost"}]}]}],"products":[{"vendor":"red hat","product":"red hat openstack platform 13.0 (queens) for rhel 7.6 eus"},{"vendor":"red hat","product":"red hat openstack platform 13.0 - els"},{"vendor":"redhat","product":"openstack_platform"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2022:8897","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-3596","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","Mitigation","Vendor Advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2136596","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","Issue Tracking","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3596","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-788f-3f4f-vv6f"},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8897.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-3596","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-3596","title":"Instack-undercloud: rsync leaks information to undercloud","description":"An information leak was found in OpenStack's undercloud. This flaw allows unauthenticated, remote attackers to inspect sensitive data after discovering the IP address of the undercloud, possibly leading to compromising private information, including administrator access credentials.","status":"published","published":"2023-09-20T19:06:28.487Z","modified":"2024-08-03T01:14:02.457Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-402"],"updated_at":"2026-11-02T14:34:33.24035Z"}],"euvd":[{"id":"EUVD-2022-42960","description":"An information leak was found in OpenStack's undercloud. This flaw allows unauthenticated, remote attackers to inspect sensitive data after discovering the IP address of the undercloud, possibly leading to compromising private information, including administrator access credentials.","status":"published","published":"2023-09-20T19:06:28Z","modified":"2024-08-03T01:14:02Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T03:25:56.994006Z"}],"ghsa":[{"id":"GHSA-788f-3f4f-vv6f","title":"An information leak was found in OpenStack's undercloud. This flaw allows unauthenticated, remote...","description":"An information leak was found in OpenStack's undercloud. This flaw allows unauthenticated, remote attackers to inspect sensitive data after discovering the IP address of the undercloud, possibly leading to compromising private information, including administrator access credentials.","status":"published","published":"2023-09-20T21:31:08Z","modified":"2024-04-04T07:46:52Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-402"],"updated_at":"2026-11-02T14:56:54.849147Z"}],"nvd":[{"id":"CVE-2022-3596","description":"An information leak was found in OpenStack's undercloud. This flaw allows unauthenticated, remote attackers to inspect sensitive data after discovering the IP address of the undercloud, possibly leading to compromising private information, including administrator access credentials.","status":"published","published":"2023-09-20T20:15:11.217Z","modified":"2026-06-17T04:59:48.85Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-402"],"updated_at":"2026-11-02T14:07:39.811118Z"}],"osv":[{"id":"RHSA-2022:8897","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 13.0 (instack-undercloud) security update","status":"published","published":"2024-09-13T21:04:08Z","modified":"2026-06-29T10:44:52Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:10.139266Z"}]}}