{"id":"CVE-2022-1655","url":"https://www.cyber-defence.io/tools/cve/CVE-2022-1655","generatedAt":"2026-10-27T20:42:39.694Z","title":"An Incorrect Permission Assignment for Critical Resource flaw was found in Horizon on Red Hat OpenStack.","description":"An Incorrect Permission Assignment for Critical Resource flaw was found in Horizon on Red Hat OpenStack. Horizon session cookies are created without the HttpOnly flag despite HorizonSecureCookies being set to true in the environmental files, possibly leading to a loss of confidentiality and integrity.","published":"2022-07-22T15:15:08.000Z","lastModified":"2026-06-17T04:22:52.000Z","status":"Modified","sourceIdentifier":"secalert@redhat.com","cvss":{"version":"3.1","score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},"cwe":["CWE-732"],"affected":["redhat/openstack"],"epss":{"score":0.00554,"percentile":0.4597,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.55%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://access.redhat.com/security/cve/cve-2022-1655","tags":["Vendor Advisory"],"source":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/cve-2022-1655","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-1655","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}