Credentials Exposure in Anchore Enterprise Software Bill of Materials
CVE-2022-1766

7.5HIGH

Key Information:

Vendor: Anchore Inc.
Status: Anchore Enterprise; Anchorectl
Vendor: CVE Published:; 20 July 2022

🔔 Create Anchore Inc. Vulnerability Alert

What is CVE-2022-1766?

In Anchore Enterprise, version 0.1.4 of the anchorectl tool improperly stores credentials used to access the Anchore Enterprise API within the generated Software Bill of Materials (SBOM). This can lead to unintentional exposure of sensitive credentials to unauthorized users. To mitigate this vulnerability, users are advised to upgrade to anchorectl version 0.1.5, which addresses the issue of credential exposure.

Affected Version(s)

Anchore Enterprise < 4.0.1

AnchoreCTL < 0.1.5

References

https://docs.anchore.com/current/docs/releasenotes/401/

x_refsource_CONFIRM

CVSS V3.1

Score:

7.5

Severity:

HIGH

Confidentiality:

High

Integrity:

None

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jul 20, 2022
Vulnerability Reserved
May 17, 2022

CVE-2022-1766 Data

JSON