Cleartext Credential Exposure in IBM Spectrum Protect Plus Log File

CVE-2022-22396

What is CVE-2022-22396?

The vulnerability reveals sensitive credentials, such as remote vSnap and offload target information, in clear text within the log files of IBM Spectrum Protect Plus, specifically versions 10.1.0.0 to 10.1.9.3. This exposure occurs under certain conditions and can potentially allow unauthorized access to critical system resources. While credentials using API keys or certificates remain protected, the risk associated with cleartext credentials poses a significant threat to the security of the system, necessitating immediate attention and remediation by affected users.

References