CVE-2022-1662

EPSS 0.04%
Published 14.07.2022 15:15:07
Last modified 21.11.2024 06:41:12
Source secalert@redhat.com
Teams watchlist Login
Open Login

In convert2rhel, there's an ansible playbook named ansible/run-convert2rhel.yml which passes the Red Hat Subscription Manager user password via the CLI to convert2rhel. This could allow unauthorized local users to view the password via the process list while convert2rhel is running. However, this ansible playbook is only an example in the upstream repository and it is not shipped in officially supported versions of convert2rhel.

Affected products Warnungen 0 Metrics 2 CWE 1 References 4

Data is provided by the National Vulnerability Database (NVD)

Convert2rhel Project ≫ Convert2rhel Version0.24

Convert2rhel Project ≫ Convert2rhel Version0.25

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.04%	0.121

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	5.5	1.8	3.6	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

https://bugzilla.redhat.com/show_bug.cgi?id=2083851

Patch

Third Party Advisory

Issue Tracking

https://nvd.nist.gov/vuln/detail/CVE-2022-1662

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2022-1662

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2022-1662

EUVD