CVE-2022-47951

MediumCVSS 5.7/10Last modified Jun 17, 2026

Description

An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data.

Metrics

CVSS 3.1 5.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Jan 26, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-479523.3lxc-user-nic in lxc through 5.0.1 is installed setuid root, and may allow local users to infer whether any file exists, even within a protecCVE-2022-47968.1Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-479657.8The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13. An app may be able to execute arbitrary codeCVE-2022-479669.8Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache SanCVE-2022-479677.8A vulnerability has been identified in Solid Edge (All versions < V2023 MP1). The DOCMGMT.DLL contains a memory corruption vulnerability thaCVE-2022-479685.4Heimdall Application Dashboard through 2.5.4 allows reflected and stored XSS via "Application name" to the "Add application" page. The storeCVE-2022-47974.3Improper Restriction of Excessive Authentication Attempts in GitHub repository usememos/memos prior to 0.9.1.CVE-2022-479746.5The Bluetooth AVRCP module has a vulnerability that can lead to DoS attacks.Successful exploitation of this vulnerability may cause the BlueCVE-2022-479757.5The DUBAI module has a double free vulnerability. Successful exploitation of this vulnerability may affect system availability.CVE-2022-479767.5The DMSDP module of the distributed hardware has a vulnerability that may cause imposter control connections.Successful exploitation of thisCVE-2022-479777.8A vulnerability has been identified in JT Open (All versions < V11.2.3.0), JT Utilities (All versions < V13.2.3.0). The affected applicationCVE-2022-47985.3Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.