CVE-2022-45154 - OpenCVE

A Cleartext Storage of Sensitive Information vulnerability in suppportutils of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 15 SP3 allows attackers that get access to the support logs to gain knowledge of the stored credentials This issue affects: SUSE Linux Enterprise Server 12 supportutils version 3.0.10-95.51.1CWE-312: Cleartext Storage of Sensitive Information and prior versions. SUSE Linux Enterprise Server 15 supportutils version 3.1.21-150000.5.44.1 and prior versions. SUSE Linux Enterprise Server 15 SP3 supportutils version 3.1.21-150300.7.35.15.1 and prior versions.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Opensuse	Supportutils
Suse	Linux Enterprise Server

Configuration 1 [-]

AND

cpe:2.3:a:opensuse:supportutils:*:*:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:12:-:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:a:opensuse:supportutils:*:*:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:15:-:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:a:opensuse:supportutils:*:*:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:15:sp3:*:*:*:*:*:*

No data.

References

Link	Providers
https://bugzilla.suse.com/show_bug.cgi?id=1207598

History

No history.

MITRE

Status: PUBLISHED

Assigner: suse

Published: 2023-02-15T00:00:00

Updated: 2024-08-03T14:09:56.382Z

Reserved: 2022-11-11T00:00:00

Link: CVE-2022-45154

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2023-02-15T10:15:17.377

Modified: 2023-02-24T18:58:26.687

Link: CVE-2022-45154

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-45154", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "assignerShortName": "suse", "dateUpdated": "2024-08-03T14:09:56.382Z", "dateReserved": "2022-11-11T00:00:00", "datePublished": "2023-02-15T00:00:00"}, "containers": {"cna": {"title": "supportconfig does not remove passwords in /etc/iscsi/iscsid.conf and /etc/target/lio_setup.sh", "datePublic": "2023-01-26T00:00:00", "providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2023-02-15T00:00:00"}, "descriptions": [{"lang": "en", "value": "A Cleartext Storage of Sensitive Information vulnerability in suppportutils of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 15 SP3 allows attackers that get access to the support logs to gain knowledge of the stored credentials This issue affects: SUSE Linux Enterprise Server 12 supportutils version 3.0.10-95.51.1CWE-312: Cleartext Storage of Sensitive Information and prior versions. SUSE Linux Enterprise Server 15 supportutils version 3.1.21-150000.5.44.1 and prior versions. SUSE Linux Enterprise Server 15 SP3 supportutils version 3.1.21-150300.7.35.15.1 and prior versions."}], "affected": [{"vendor": "SUSE", "product": "SUSE Linux Enterprise Server 12", "versions": [{"version": "supportutils", "status": "affected", "lessThanOrEqual": "3.0.10-95.51.1CWE-312: Cleartext Storage of Sensitive Information", "versionType": "custom"}]}, {"vendor": "SUSE", "product": "SUSE Linux Enterprise Server 15", "versions": [{"version": "supportutils", "status": "affected", "lessThanOrEqual": "3.1.21-150000.5.44.1", "versionType": "custom"}]}, {"vendor": "SUSE", "product": "SUSE Linux Enterprise Server 15 SP3", "versions": [{"version": "supportutils", "status": "affected", "lessThanOrEqual": "3.1.21-150300.7.35.15.1", "versionType": "custom"}]}], "references": [{"url": "https://bugzilla.suse.com/show_bug.cgi?id=1207598"}], "credits": [{"lang": "en", "value": "Nozomi Matsuzawa"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "LOW", "baseScore": 4.4, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-312: Cleartext Storage of Sensitive Information", "cweId": "CWE-312"}]}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "source": {"advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1207598", "defect": ["1207598"], "discovery": "INTERNAL"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T14:09:56.382Z"}, "title": "CVE Program Container", "references": [{"url": "https://bugzilla.suse.com/show_bug.cgi?id=1207598", "tags": ["x_transferred"]}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:opensuse:supportutils:*:*:*:*:*:*:*:*", "matchCriteriaId": "8CA61E84-D366-4E82-A0F2-B26445610EB6", "versionEndIncluding": "3.0.10-95.51.1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:suse:linux_enterprise_server:12:-:*:*:*:*:*:*", "matchCriteriaId": "15FC9014-BD85-4382-9D04-C0703E901D7A", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:opensuse:supportutils:*:*:*:*:*:*:*:*", "matchCriteriaId": "3CA4BD70-03B8-4CBD-8532-C75BC77F3722", "versionEndIncluding": "3.1.21-150000.5.44.1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:suse:linux_enterprise_server:15:-:*:*:*:*:*:*", "matchCriteriaId": "0BB4DDAB-D900-4EC0-99E8-1D6AB48F6D20", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:opensuse:supportutils:*:*:*:*:*:*:*:*", "matchCriteriaId": "02F152EA-2162-4750-9A40-01BAD9FAF936", "versionEndIncluding": "3.1.21-150300.7.35.15.1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:suse:linux_enterprise_server:15:sp3:*:*:*:*:*:*", "matchCriteriaId": "6C2EACE6-C127-4B13-8002-8EEBEE8D549B", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A Cleartext Storage of Sensitive Information vulnerability in suppportutils of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 15 SP3 allows attackers that get access to the support logs to gain knowledge of the stored credentials This issue affects: SUSE Linux Enterprise Server 12 supportutils version 3.0.10-95.51.1CWE-312: Cleartext Storage of Sensitive Information and prior versions. SUSE Linux Enterprise Server 15 supportutils version 3.1.21-150000.5.44.1 and prior versions. SUSE Linux Enterprise Server 15 SP3 supportutils version 3.1.21-150300.7.35.15.1 and prior versions."}], "id": "CVE-2022-45154", "lastModified": "2023-02-24T18:58:26.687", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 2.5, "source": "meissner@suse.de", "type": "Secondary"}]}, "published": "2023-02-15T10:15:17.377", "references": [{"source": "meissner@suse.de", "tags": ["Exploit", "Issue Tracking"], "url": "https://bugzilla.suse.com/show_bug.cgi?id=1207598"}], "sourceIdentifier": "meissner@suse.de", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-312"}], "source": "meissner@suse.de", "type": "Primary"}]}