Medium severity · published Feb 15, 2023
CVE-2022-45154
A Cleartext Storage of Sensitive Information vulnerability in suppportutils of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 15…
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
A Cleartext Storage of Sensitive Information vulnerability in suppportutils of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 15 SP3 allows attackers that get access to the support logs to gain knowledge of the stored credentials This issue affects: SUSE Linux Enterprise Server 12 supportutils version 3.0.10-95.51.1CWE-312: Cleartext Storage of Sensitive Information and prior versions. SUSE Linux Enterprise Server 15 supportutils version 3.1.21-150000.5.44.1 and prior versions. SUSE Linux Enterprise Server 15 SP3 supportutils version 3.1.21-150300.7.35.15.1 and prior versions.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SU
Supportutils · Opensuse
through 3.0.10-95.51.1; through 3.1.21-150000.5.44.1; through 3.1.21-150300.7.35.15.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-45154
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-45154
Exploit
https://bugzilla.suse.com/show_bug.cgi?id=1207598
More from Supportutils
7.8
CVE-2018-19636
Local root exploit via inclusion of attacker controlled shell script
7.8
CVE-2018-19639
Code execution if run with command line switch -v
5.5
CVE-2018-19637
Static temporary filename allows overwriting of files
5.5
CVE-2018-19640
Code execution if run with command line switch -v
4.7
CVE-2018-19638
User can overwrite arbitrary log files in support tar