Medium severity · published Mar 6, 2023
CVE-2022-3854
A flaw was found in Ceph, relating to the URL processing on RGW backends
6.5
CVSS
0.6%
EPSS
No
On KEV
Description
A flaw was found in Ceph, relating to the URL processing on RGW backends. An attacker can exploit the URL processing by providing a null URL to crash the RGW, causing a denial of service.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Ceph Storage · Redhat
3.0; 4.0; 5.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-3854
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-3854
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2139925
More from Ceph Storage
9.8
CVE-2022-26148
An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix
9.8
CVE-2021-20236
A flaw was found in the ZeroMQ server in versions before 4.3.3
9.8
CVE-2018-14649
It was found that ceph-isci-cli package as shipped by Red Hat Ceph Storage 2 and 3 is using python-werkzeug in debug shell mode
9.8
CVE-2018-15727
Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of…
9.1
CVE-2022-0670
A flaw was found in Openstack manilla owning a Ceph File system "share", which enables the owner to read/write any manilla share or entire file system