Cleartext Credential Exposure in IBM Spectrum Protect Plus Log File
CVE-2022-22396

6.8MEDIUM

Key Information:

Vendor
IBM
Status
Spectrum Protect Plus
Vendor
CVE Published:
6 June 2022

Summary

The vulnerability reveals sensitive credentials, such as remote vSnap and offload target information, in clear text within the log files of IBM Spectrum Protect Plus, specifically versions 10.1.0.0 to 10.1.9.3. This exposure occurs under certain conditions and can potentially allow unauthorized access to critical system resources. While credentials using API keys or certificates remain protected, the risk associated with cleartext credentials poses a significant threat to the security of the system, necessitating immediate attention and remediation by affected users.

Affected Version(s)

Spectrum Protect Plus 10.1.0.0

Spectrum Protect Plus 10.1.9.3

References

https://www.ibm.com/support/pages/node/6591505
x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilities/222231
vdb-entryx_refsource_XF

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.