CVE-2022-2569

The affected device stores sensitive information in cleartext, which may allow an authenticated user to access session data stored in the OAuth database belonging to legitimate users

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-01-0	Patch Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:arcinformatique:pcvue::::::::
	cpe:2.3:a:arcinformatique:pcvue::::::::

History

30 Aug 2022, 19:03

Type	Values Removed	Values Added
References	~~(MISC) https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-01-0 -~~	(MISC) https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-01-0 - Patch, Third Party Advisory, US Government Resource
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.5
CPE		cpe:2.3:a:arcinformatique:pcvue::::::::

24 Aug 2022, 16:24

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-08-24 16:15

Updated : 2024-02-04 22:51

NVD link : CVE-2022-2569

Mitre link : CVE-2022-2569

CVE.ORG link : CVE-2022-2569

JSON object : View

Products Affected

arcinformatique

pcvue

CWE

CWE-312

Cleartext Storage of Sensitive Information

{"id": "CVE-2022-2569", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2022-08-24T16:15:11.907", "references": [{"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-01-0", "tags": ["Patch", "Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-312"}]}], "descriptions": [{"lang": "en", "value": "The affected device stores sensitive information in cleartext, which may allow an authenticated user to access session data stored in the OAuth database belonging to legitimate users"}, {"lang": "es", "value": "El dispositivo afectado almacena informaci\u00f3n confidencial en texto sin cifrar, lo que puede permitir a un usuario autenticado acceder a los datos de sesi\u00f3n almacenados en la base de datos OAuth que pertenecen a usuarios leg\u00edtimos"}], "lastModified": "2022-08-30T19:03:35.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:arcinformatique:pcvue:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0A2EA2CE-971E-4267-9503-771CEA1205CE", "versionEndExcluding": "12.0.27"}, {"criteria": "cpe:2.3:a:arcinformatique:pcvue:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "51A06B7D-3E27-4F4A-838F-59523C12A88B", "versionEndIncluding": "15.2.2", "versionStartIncluding": "15"}], "operator": "OR"}]}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}