CVE-2022-3287 - Vulnerability Details - OpenCVE

When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same configuration file.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Fwupd	Fwupd
Redhat	Enterprise Linux Rhel Eus

Configuration 1 [-]

cpe:2.3:a:fwupd:fwupd:*:*:*:*:*:*:*:*

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 8
fwupd-0:1.7.8-2.el8	cpe:/o:redhat:enterprise_linux:8	RHSA-2023:7189	2023-11-14T00:00:00Z
Red Hat Enterprise Linux 8.6 Extended Update Support
fwupd-0:1.7.4-3.el8_6	cpe:/o:redhat:rhel_eus:8.6	RHSA-2024:1106	2024-03-05T00:00:00Z
Red Hat Enterprise Linux 8.8 Extended Update Support
fwupd-0:1.7.8-2.el8_8	cpe:/o:redhat:rhel_eus:8.8	RHSA-2024:1403	2024-03-19T00:00:00Z
Red Hat Enterprise Linux 9
fwupd-0:1.8.10-2.el9	cpe:/a:redhat:enterprise_linux:9	RHSA-2023:2487	2023-05-09T00:00:00Z
fwupd-0:1.8.10-2.el9	cpe:/o:redhat:enterprise_linux:9	RHSA-2023:2487	2023-05-09T00:00:00Z

References

Link	Providers
https://github.com/fwupd/fwupd/commit/ea676855f2119e36d433fbd2ed604039f53b2091
https://nvd.nist.gov/vuln/detail/CVE-2022-3287
https://www.cve.org/CVERecord?id=CVE-2022-3287

History

Tue, 20 May 2025 21:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2022-09-28T19:07:38.000Z

Updated: 2025-05-20T20:12:47.373Z

Reserved: 2022-09-23T00:00:00.000Z

Link: CVE-2022-3287

Vulnrichment

Updated: 2024-08-03T01:07:06.424Z

NVD

Status : Modified

Published: 2022-09-28T20:15:18.433

Modified: 2025-05-20T20:15:23.753

Link: CVE-2022-3287

Redhat

Severity : Moderate

Publid Date: 2022-09-22T00:00:00Z

Links: CVE-2022-3287 - Bugzilla

{"containers": {"cna": {"affected": [{"product": "fwupd", "vendor": "n/a", "versions": [{"status": "affected", "version": "Fixed in version 1.8.5"}]}], "descriptions": [{"lang": "en", "value": "When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same configuration file."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-256", "description": "CWE-256 | CWE-552", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-09-28T19:07:38.000Z", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/fwupd/fwupd/commit/ea676855f2119e36d433fbd2ed604039f53b2091"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2022-3287", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "fwupd", "version": {"version_data": [{"version_value": "Fixed in version 1.8.5"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same configuration file."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-256 | CWE-552"}]}]}, "references": {"reference_data": [{"name": "https://github.com/fwupd/fwupd/commit/ea676855f2119e36d433fbd2ed604039f53b2091", "refsource": "MISC", "url": "https://github.com/fwupd/fwupd/commit/ea676855f2119e36d433fbd2ed604039f53b2091"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T01:07:06.424Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/fwupd/fwupd/commit/ea676855f2119e36d433fbd2ed604039f53b2091"}]}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-05-20T20:11:48.140766Z", "id": "CVE-2022-3287", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-20T20:12:47.373Z"}}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2022-3287", "datePublished": "2022-09-28T19:07:38.000Z", "dateReserved": "2022-09-23T00:00:00.000Z", "dateUpdated": "2025-05-20T20:12:47.373Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/fwupd/fwupd/commit/ea676855f2119e36d433fbd2ed604039f53b2091", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T01:07:06.424Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2022-3287", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-20T20:11:48.140766Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-20T20:11:29.692Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "fwupd", "versions": [{"status": "affected", "version": "Fixed in version 1.8.5"}]}], "references": [{"url": "https://github.com/fwupd/fwupd/commit/ea676855f2119e36d433fbd2ed604039f53b2091", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same configuration file."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-256", "description": "CWE-256 | CWE-552"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2022-09-28T19:07:38.000Z"}, "x_legacyV4Record": {"affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_value": "Fixed in version 1.8.5"}]}, "product_name": "fwupd"}]}, "vendor_name": "n/a"}]}}, "data_type": "CVE", "references": {"reference_data": [{"url": "https://github.com/fwupd/fwupd/commit/ea676855f2119e36d433fbd2ed604039f53b2091", "name": "https://github.com/fwupd/fwupd/commit/ea676855f2119e36d433fbd2ed604039f53b2091", "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same configuration file."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-256 | CWE-552"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2022-3287", "STATE": "PUBLIC", "ASSIGNER": "[email protected]"}}}}, "cveMetadata": {"cveId": "CVE-2022-3287", "state": "PUBLISHED", "dateUpdated": "2025-05-20T20:12:47.373Z", "dateReserved": "2022-09-23T00:00:00.000Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2022-09-28T19:07:38.000Z", "assignerShortName": "redhat"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fwupd:fwupd:*:*:*:*:*:*:*:*", "matchCriteriaId": "6D1E50C4-33F3-42A4-A6C5-4BD995A86434", "versionEndExcluding": "1.8.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same configuration file."}, {"lang": "es", "value": "Cuando era creada una cuenta de usuario OPERATOR en el BMC, el plugin redfish guardaba la contrase\u00f1a autogenerada en /etc/fwupd/redfish.conf sin una restricci\u00f3n apropiada, permitiendo a cualquier usuario del sistema leer el mismo archivo de configuraci\u00f3n"}], "id": "CVE-2022-3287", "lastModified": "2025-05-20T20:15:23.753", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "[email protected]", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2022-09-28T20:15:18.433", "references": [{"source": "[email protected]", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/fwupd/fwupd/commit/ea676855f2119e36d433fbd2ed604039f53b2091"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/fwupd/fwupd/commit/ea676855f2119e36d433fbd2ed604039f53b2091"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-256"}], "source": "[email protected]", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-552"}], "source": "[email protected]", "type": "Primary"}]}