CVE-2022-47950

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server, resulting in unauthorized read access to potentially sensitive data. This impacts both s3api deployments (Rocky or later), and swift3 deployments (Queens and earlier, no longer actively developed).

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-552

Affected software

No affected versions have been published.

Timeline

Published: Jan 18, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-479515.7An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.CVE-2022-479523.3lxc-user-nic in lxc through 5.0.1 is installed setuid root, and may allow local users to infer whether any file exists, even within a protec CVE-2022-47968.1Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-479657.8The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13. An app may be able to execute arbitrary code CVE-2022-479669.8Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache San CVE-2022-479677.8A vulnerability has been identified in Solid Edge (All versions < V2023 MP1). The DOCMGMT.DLL contains a memory corruption vulnerability tha CVE-2022-479685.4Heimdall Application Dashboard through 2.5.4 allows reflected and stored XSS via "Application name" to the "Add application" page. The store CVE-2022-47974.3Improper Restriction of Excessive Authentication Attempts in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-479746.5The Bluetooth AVRCP module has a vulnerability that can lead to DoS attacks.Successful exploitation of this vulnerability may cause the Blue CVE-2022-479757.5The DUBAI module has a double free vulnerability. Successful exploitation of this vulnerability may affect system availability.CVE-2022-479767.5The DMSDP module of the distributed hardware has a vulnerability that may cause imposter control connections.Successful exploitation of this CVE-2022-479777.8A vulnerability has been identified in JT Open (All versions < V11.2.3.0), JT Utilities (All versions < V13.2.3.0). The affected application