An insertion of sensitive information into log file vulnerability exists in PcVue versions 15 through 15.2.2. This
could allow a user with access to the log files to discover connection strings of data sources configured for the
DbConnect, which could include credentials. Successful exploitation of this vulnerability could allow other users
unauthorized access to the underlying data sources.
References
Link | Resource |
---|---|
https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1165-security-bulletin-2022-6 | Permissions Required Vendor Advisory |
https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1165-security-bulletin-2022-6 | Permissions Required Vendor Advisory |
Configurations
History
21 Nov 2024, 07:35
Type | Values Removed | Values Added |
---|---|---|
References | () https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1165-security-bulletin-2022-6 - Permissions Required, Vendor Advisory | |
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.7 |
07 Nov 2023, 03:57
Type | Values Removed | Values Added |
---|---|---|
Summary | An insertion of sensitive information into log file vulnerability exists in PcVue versions 15 through 15.2.2. This could allow a user with access to the log files to discover connection strings of data sources configured for the DbConnect, which could include credentials. Successful exploitation of this vulnerability could allow other users unauthorized access to the underlying data sources. |
Information
Published : 2022-12-12 18:15
Updated : 2024-11-21 07:35
NVD link : CVE-2022-4311
Mitre link : CVE-2022-4311
CVE.ORG link : CVE-2022-4311
JSON object : View
Products Affected
arcinformatique
- pcvue
CWE
CWE-532
Insertion of Sensitive Information into Log File