CVE-2022-3277

moderate-risk

Published 2023-03-06

An uncontrolled resource consumption flaw was found in openstack-neutron. This flaw allows a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota. If a malicious user were to submit a significant number of requests, this could lead to a denial of service.

Do I need to act?

0.55% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.5/10 Medium

NETWORK / LOW complexity

Affected Products (4)

Neutron

Openstack Platform

Affected Vendors

Redhat Openstack

References (6)

Issue Tracking https://bugs.launchpad.net/neutron/+bug/1988026

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=2129193

Issue Tracking https://bugs.launchpad.net/neutron/+bug/1988026

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=2129193

Issue Tracking https://bugs.launchpad.net/neutron/+bug/1988026

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=2129193

/ 100

moderate-risk

Severity 24/34 · High

Exploitability 2/34 · Minimal

Exposure 10/34 · Low