CVE-2022-4311

An insertion of sensitive information into log file vulnerability exists in PcVue versions 15 through 15.2.2. This could allow a user with access to the log files to discover connection strings of data sources configured for the DbConnect, which could include credentials. Successful exploitation of this vulnerability could allow other users unauthorized access to the underlying data sources.

CVSS v3 4.7 MEDIUM

4.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.0 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1165-security-bulletin-2022-6	Permissions Required Vendor Advisory
https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1165-security-bulletin-2022-6	Permissions Required Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:arcinformatique:pcvue:*:*:*:*:*:*:*:*

History

21 Nov 2024, 07:35

Type	Values Removed	Values Added
Summary		(es) Existe una vulnerabilidad de inserción de información confidencial en el archivo de registro en las versiones de PcVue 15 a 15.2.2. Esto podría permitir que un usuario con acceso a los archivos de registro descubra cadenas de conexión de fuentes de datos configuradas para DbConnect, que podrían incluir credenciales. La explotación exitosa de esta vulnerabilidad podría permitir que otros usuarios accedan no autorizados a las fuentes de datos subyacentes.
CVSS	v2 : ~~unknown~~ v3 : ~~6.5~~	v2 : unknown v3 : 4.7
References	~~() https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1165-security-bulletin-2022-6 - Permissions Required, Vendor Advisory~~	() https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1165-security-bulletin-2022-6 - Permissions Required, Vendor Advisory

Information

Published : 2022-12-12 18:15

Updated : 2024-11-21 07:35

NVD link : CVE-2022-4311

Mitre link : CVE-2022-4311

CVE.ORG link : CVE-2022-4311

JSON object : View

Products Affected

arcinformatique

pcvue

CWE

CWE-532

Insertion of Sensitive Information into Log File

{"id": "CVE-2022-4311", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.0}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2022-12-12T18:15:13.300", "references": [{"url": "https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1165-security-bulletin-2022-6", "tags": ["Permissions Required", "Vendor Advisory"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1165-security-bulletin-2022-6", "tags": ["Permissions Required", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-532"}]}], "descriptions": [{"lang": "en", "value": "\nAn insertion of sensitive information into log file vulnerability exists in PcVue versions 15 through 15.2.2. This\ncould allow a user with access to the log files to discover connection strings of data sources configured for the\nDbConnect, which could include credentials. Successful exploitation of this vulnerability could allow other users\nunauthorized access to the underlying data sources.\n\n"}, {"lang": "es", "value": "Existe una vulnerabilidad de inserci\u00f3n de informaci\u00f3n confidencial en el archivo de registro en las versiones de PcVue 15 a 15.2.2. Esto podr\u00eda permitir que un usuario con acceso a los archivos de registro descubra cadenas de conexi\u00f3n de fuentes de datos configuradas para DbConnect, que podr\u00edan incluir credenciales. La explotaci\u00f3n exitosa de esta vulnerabilidad podr\u00eda permitir que otros usuarios accedan no autorizados a las fuentes de datos subyacentes."}], "lastModified": "2024-11-21T07:35:00.413", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:arcinformatique:pcvue:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "51A06B7D-3E27-4F4A-838F-59523C12A88B", "versionEndIncluding": "15.2.2", "versionStartIncluding": "15"}], "operator": "OR"}]}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}