supportconfig does not remove passwords in /etc/iscsi/iscsid.conf and /etc/target/lio_setup.sh

CVE-2022-45154
4.4MEDIUM

Key Information

Vendor
Suse
Status
Suse Linux Enterprise Server 12
Suse Linux Enterprise Server 15
Suse Linux Enterprise Server 15 Sp3
Vendor
CVE Published:
15 February 2023

Summary

A Cleartext Storage of Sensitive Information vulnerability in suppportutils of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 15 SP3 allows attackers that get access to the support logs to gain knowledge of the stored credentials This issue affects: SUSE Linux Enterprise Server 12 supportutils version 3.0.10-95.51.1CWE-312: Cleartext Storage of Sensitive Information and prior versions. SUSE Linux Enterprise Server 15 supportutils version 3.1.21-150000.5.44.1 and prior versions. SUSE Linux Enterprise Server 15 SP3 supportutils version 3.1.21-150300.7.35.15.1 and prior versions.

Affected Version(s)

SUSE Linux Enterprise Server 12 <= 3.0.10-95.51.1CWE-312: Cleartext Storage of Sensitive Information

SUSE Linux Enterprise Server 15 <= 3.1.21-150000.5.44.1

SUSE Linux Enterprise Server 15 SP3 <= 3.1.21-150300.7.35.15.1

CVSS V3.1

Score:
4.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Risk change from: 5.5 to: 4.4 - (MEDIUM)

  • Vulnerability published.

  • Vulnerability Reserved.

Collectors

NVD DatabaseMitre Database

Credit

Nozomi Matsuzawa
.