Read the docs
TI-2022-23762 Aliases CVE-2022-47951GHSA-7h75-hwxx-qpgc

An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and…

Priority MEDIUM 59CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-22 and the CVSS impact.

Summary

An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01063 64th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed cinder (PyPI): 19.1.2, 20.0.2glance (PyPI): 23.0.1, 24.1.1+1 more productRed Hat: 6 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—cinder (PyPI)before 19.1.219.1.2Patch availableGHSA-7h75-hwxx-qpgc
—cinder (PyPI)20.0.0 to before 20.0.220.0.2Patch availableGHSA-7h75-hwxx-qpgc
—glance (PyPI)before 23.0.123.0.1Patch availableGHSA-7h75-hwxx-qpgc
—glance (PyPI)24.0.0 to before 24.1.124.1.1Patch availableGHSA-7h75-hwxx-qpgc
—nova (PyPI)before 24.1.224.1.2Patch availableGHSA-7h75-hwxx-qpgc
—nova (PyPI)25.0.0 to before 25.0.225.0.2Patch availableGHSA-7h75-hwxx-qpgc
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • cinder (PyPI) Vendor— Affected before 19.1.2 Fixed in 19.1.2 Patch available GHSA-7h75-hwxx-qpgc
  • cinder (PyPI) Vendor— Affected 20.0.0 to before 20.0.2 Fixed in 20.0.2 Patch available GHSA-7h75-hwxx-qpgc
  • glance (PyPI) Vendor— Affected before 23.0.1 Fixed in 23.0.1 Patch available GHSA-7h75-hwxx-qpgc
  • glance (PyPI) Vendor— Affected 24.0.0 to before 24.1.1 Fixed in 24.1.1 Patch available GHSA-7h75-hwxx-qpgc
  • nova (PyPI) Vendor— Affected before 24.1.2 Fixed in 24.1.2 Patch available GHSA-7h75-hwxx-qpgc
  • nova (PyPI) Vendor— Affected 25.0.0 to before 25.0.2 Fixed in 25.0.2 Patch available GHSA-7h75-hwxx-qpgc

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:openstack:cinder:*:*:*:*:*:*:*:*up to 19.1.2; 20.0.0 to before 20.0.2VulnerableOpenStack
cpe:2.3:a:openstack:glance:*:*:*:*:*:*:*:*before 23.0.1; 24.0.0 to before 24.1.1VulnerableOpenStack
cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:*before 24.1.2; 25.0.0 to before 25.0.2VulnerableOpenStack
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
  • cpe:2.3:a:openstack:cinder:*:*:*:*:*:*:*:* Versions up to 19.1.2; 20.0.0 to before 20.0.2 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:glance:*:*:*:*:*:*:*:* Versions before 23.0.1; 24.0.0 to before 24.1.1 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:* Versions before 24.1.2; 25.0.0 to before 25.0.2 Vulnerable ·OpenStack
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian

Remediation

  • Fix · GHSA-7h75-hwxx-qpgc cinder (PyPI) Fixed in 19.1.2 Advisory →
  • Fix · GHSA-7h75-hwxx-qpgc cinder (PyPI) Fixed in 20.0.2 Advisory →
  • Fix · GHSA-7h75-hwxx-qpgc glance (PyPI) Fixed in 23.0.1 Advisory →
  • Fix · GHSA-7h75-hwxx-qpgc glance (PyPI) Fixed in 24.1.1 Advisory →
  • Fix · GHSA-7h75-hwxx-qpgc nova (PyPI) Fixed in 24.1.2 Advisory →
  • Fix · GHSA-7h75-hwxx-qpgc nova (PyPI) Fixed in 25.0.2 Advisory →

Red Hat 6 advisories

  • RHSA-2023:1278 Released 2023-03-15 · Red Hat rating Important
    Red Hat OpenStack Platform (openstack-nova) security update
    • Red Hat OpenStack Platform 13.0 - ELS openstack-nova-1:17.0.13-40.el7ost, openstack-nova-api-1:17.0.13-40.el7ost, openstack-nova-cells-1:17.0.13-40.el7ost +13
    • Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server openstack-nova-1:17.0.13-40.el7ost, openstack-nova-api-1:17.0.13-40.el7ost, openstack-nova-cells-1:17.0.13-40.el7ost +13
    • Red Hat OpenStack Platform 16.1 openstack-nova-1:20.4.1-1.20221005193231.1ee93b9.el8ost, openstack-nova-api-1:20.4.1-1.20221005193231.1ee93b9.el8ost, openstack-nova-common-1:20.4.1-1.20221005193231.1ee93b9.el8ost +9
    • Red Hat OpenStack Platform 16.2 openstack-nova-1:20.6.2-2.20221005185231.6786e96.el8ost, openstack-nova-api-1:20.6.2-2.20221005185231.6786e96.el8ost, openstack-nova-common-1:20.6.2-2.20221005185231.6786e96.el8ost +9
  • RHSA-2023:1279 Released 2023-03-15 · Red Hat rating Important
    Synopsis: Red Hat OpenStack Platform (openstack-cinder) security update
    • Red Hat OpenStack Platform 13.0 - ELS openstack-cinder-1:12.0.10-27.el7ost, python-cinder-1:12.0.10-27.el7ost
    • Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server openstack-cinder-1:12.0.10-27.el7ost, python-cinder-1:12.0.10-27.el7ost
    • Red Hat OpenStack Platform 16.1 openstack-cinder-1:15.4.0-1.20230206163350.58f0e73.el8ost, python3-cinder-1:15.4.0-1.20230206163350.58f0e73.el8ost
    • Red Hat OpenStack Platform 16.2 openstack-cinder-1:15.6.1-2.20221003154726.87578a0.el8ost, python3-cinder-1:15.6.1-2.20221003154726.87578a0.el8ost
  • RHSA-2023:1280 Released 2023-03-15 · Red Hat rating Important
    Synopsis: Red Hat OpenStack Platform (openstack-glance) security update
    • Red Hat OpenStack Platform 13.0 - ELS openstack-glance-1:16.0.1-13.el7ost, python-glance-1:16.0.1-13.el7ost, python-glance-tests-1:16.0.1-13.el7ost
    • Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server openstack-glance-1:16.0.1-13.el7ost, python-glance-1:16.0.1-13.el7ost, python-glance-tests-1:16.0.1-13.el7ost
    • Red Hat OpenStack Platform 16.1 openstack-glance-1:19.0.4-1.20230207203320.5bbd356.el8ost, python3-glance-1:19.0.4-1.20230207203320.5bbd356.el8ost
    • Red Hat OpenStack Platform 16.2 openstack-glance-1:19.0.5-2.20220113204850.b3de9da.el8ost, python3-glance-1:19.0.5-2.20220113204850.b3de9da.el8ost
Show 3 more Red Hat advisories
  • RHSA-2023:1017 Released 2023-02-28 · Red Hat rating Important
    Red Hat OpenStack Platform 17.0 (openstack-glance) security update
    • Red Hat OpenStack Platform 17.0 openstack-glance-1:22.1.1-0.20220919210603.677c89c.el9ost, python3-glance-1:22.1.1-0.20220919210603.677c89c.el9ost
  • RHSA-2023:1016 Released 2023-02-28 · Red Hat rating Important
    Red Hat OpenStack Platform 17.0 (openstack-cinder) security update
    • Red Hat OpenStack Platform 17.0 openstack-cinder-1:18.2.1-0.20230202190311.1776695.el9ost, python3-cinder-1:18.2.1-0.20230202190311.1776695.el9ost, python3-cinder-common-1:18.2.1-0.20230202190311.1776695.el9ost
  • RHSA-2023:1015 Released 2023-02-28 · Red Hat rating Important
    Red Hat OpenStack Platform 17.0 (openstack-nova) security update
    • Red Hat OpenStack Platform 17.0 openstack-nova-1:23.2.2-0.20221209190753.7074ac0.el9ost, openstack-nova-api-1:23.2.2-0.20221209190753.7074ac0.el9ost, openstack-nova-common-1:23.2.2-0.20221209190753.7074ac0.el9ost +8

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenStack Platform 13.0 - ELSFixed RHSA-2023:1278, RHSA-2023:1279, RHSA-2023:1280
Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS ServerFixed RHSA-2023:1278, RHSA-2023:1279, RHSA-2023:1280
Red Hat OpenStack Platform 16.1Fixed RHSA-2023:1278, RHSA-2023:1279, RHSA-2023:1280
Red Hat OpenStack Platform 16.2Fixed RHSA-2023:1278, RHSA-2023:1279, RHSA-2023:1280
Red Hat OpenStack Platform 17.0Fixed RHSA-2023:1015, RHSA-2023:1016, RHSA-2023:1017
Not affected: 4 products
  • Red Hat OpenStack Platform 13.0 - ELS
  • Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server
  • Red Hat OpenStack Platform 16.1
  • Red Hat OpenStack Platform 16.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-47951
  2. 2026-10-03 Alias added: GHSA-7h75-hwxx-qpgc

References

Exploit 1

Patch 1

Advisory 7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences