CVE-2022-29071

This advisory documents an internally found vulnerability in the on premises deployment model of Arista CloudVision Portal (CVP) where under a certain set of conditions, user passwords can be leaked in the Audit and System logs. The impact of this vulnerability is that the CVP user login passwords might be leaked to other authenticated users.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.arista.com/en/support/advisories-notices/security-advisory/15865-security-advisory-0079	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:arista:cloudvision_portal:*:*:*:*:*:*:*:*

History

21 Jul 2023, 16:44

Type	Values Removed	Values Added
CWE	~~CWE-200~~	CWE-532

Information

Published : 2022-08-05 17:15

Updated : 2024-02-28 19:29

NVD link : CVE-2022-29071

Mitre link : CVE-2022-29071

CVE.ORG link : CVE-2022-29071

JSON object : View

Products Affected

arista

cloudvision_portal

CWE

CWE-532

Insertion of Sensitive Information into Log File

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2022-29071", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "psirt@arista.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.0, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.5}]}, "published": "2022-08-05T17:15:08.500", "references": [{"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/15865-security-advisory-0079", "tags": ["Vendor Advisory"], "source": "psirt@arista.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-532"}]}, {"type": "Secondary", "source": "psirt@arista.com", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "This advisory documents an internally found vulnerability in the on premises deployment model of Arista CloudVision Portal (CVP) where under a certain set of conditions, user passwords can be leaked in the Audit and System logs. The impact of this vulnerability is that the CVP user login passwords might be leaked to other authenticated users."}, {"lang": "es", "value": "Este aviso documenta una vulnerabilidad encontrada internamente en el modelo de despliegue on premises de Arista CloudVision Portal (CVP) en el que, bajo un determinado conjunto de condiciones, las contrase\u00f1as de los usuarios pueden filtrarse en los registros de auditor\u00eda y del sistema. El impacto de esta vulnerabilidad es que las contrase\u00f1as de inicio de sesi\u00f3n de los usuarios de CVP podr\u00edan filtrarse a otros usuarios autenticados"}], "lastModified": "2023-07-21T16:44:30.400", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:arista:cloudvision_portal:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ED4D7A3F-C668-4F58-929E-4EEFF6E15C94", "versionEndIncluding": "2022.1.0", "versionStartIncluding": "2020.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@arista.com"}