cve/2022/CVE-2022-3287.md

### [CVE-2022-3287](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3287)
![](https://img.shields.io/static/v1?label=Product&message=fwupd&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-256%20%7C%20CWE-552&color=brighgreen)

### Description

When creating an OPERATOR user account on the BMC, the redfish plugin saved the auto-generated password to /etc/fwupd/redfish.conf without proper restriction, allowing any user on the system to read the same configuration file.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/chnzzh/Redfish-CVE-lib