Lucene search

K
cvelistSuseCVELIST:CVE-2022-45154
HistoryFeb 15, 2023 - 12:00 a.m.

CVE-2022-45154 supportconfig does not remove passwords in /etc/iscsi/iscsid.conf and /etc/target/lio_setup.sh

2023-02-1500:00:00
CWE-312
suse
www.cve.org
1
cve-2022-45154
supportconfig
cleartext storage of sensitive information
suse linux enterprise server 12
suse linux enterprise server 15
suse linux enterprise server 15 sp3
supportutils
/etc/iscsi/iscsid.conf
/etc/target/lio_setup.sh
cwe-312
vulnerability

4.4 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

5.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

A Cleartext Storage of Sensitive Information vulnerability in suppportutils of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 15 SP3 allows attackers that get access to the support logs to gain knowledge of the stored credentials This issue affects: SUSE Linux Enterprise Server 12 supportutils version 3.0.10-95.51.1CWE-312: Cleartext Storage of Sensitive Information and prior versions. SUSE Linux Enterprise Server 15 supportutils version 3.1.21-150000.5.44.1 and prior versions. SUSE Linux Enterprise Server 15 SP3 supportutils version 3.1.21-150300.7.35.15.1 and prior versions.

CNA Affected

[
  {
    "vendor": "SUSE",
    "product": "SUSE Linux Enterprise Server 12",
    "versions": [
      {
        "version": "supportutils",
        "status": "affected",
        "lessThanOrEqual": "3.0.10-95.51.1CWE-312: Cleartext Storage of Sensitive Information",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "SUSE",
    "product": "SUSE Linux Enterprise Server 15",
    "versions": [
      {
        "version": "supportutils",
        "status": "affected",
        "lessThanOrEqual": "3.1.21-150000.5.44.1",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "SUSE",
    "product": "SUSE Linux Enterprise Server 15 SP3",
    "versions": [
      {
        "version": "supportutils",
        "status": "affected",
        "lessThanOrEqual": "3.1.21-150300.7.35.15.1",
        "versionType": "custom"
      }
    ]
  }
]

4.4 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

5.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

Related for CVELIST:CVE-2022-45154