Lucene search

[email protected]CVE-2022-36617

HistorySep 09, 2022 - 4:15 p.m.

CVE-2022-36617

2022-09-0916:15:08

CWE-522

[email protected]

web.nvd.nist.gov

arq backup

cve-2022-36617

encryption

reversible encryption

administrative privileges

cleartext passwords

nvd

4.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

5.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

26.0%

JSON

Arq Backup 7.19.5.0 and below stores backup encryption passwords using reversible encryption. This issue allows attackers with administrative privileges to recover cleartext passwords.

Affected configurations

NVD

Node

haystacksoftwarearq_backupRange≤7.19.5.0

CPENameOperatorVersion
haystacksoftware:arq_backuphaystacksoftware arq backuple7.19.5.0

CPE	Name	Operator	Version
haystacksoftware:arq_backup	haystacksoftware arq backup	le	7.19.5.0

References

startrekdude.github.io/arqbackup.html

www.arqbackup.com/download/arqbackup/arq7windows_release_notes.html

Social References

4.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

5.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

26.0%

JSON

Related for CVE-2022-36617

prion1 cvelist1 nvd1