VULNERABILITY INTELLIGENCE

CVE-2022-1655

CVSS score6.5 MEDIUM
EPSS probability0.55%
CISA KEVNot currently listed
Published2022-07-22
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Description

An Incorrect Permission Assignment for Critical Resource flaw was found in Horizon on Red Hat OpenStack. Horizon session cookies are created without the HttpOnly flag despite HorizonSecureCookies being set to true in the environmental files, possibly leading to a loss of confidentiality and integrity.

Weakness classification

  • secalert@redhat.com: CWE-732
  • nvd@nist.gov: CWE-732

Primary references