CVE-2022-45154 - Vulnerability Details - OpenCVE

A Cleartext Storage of Sensitive Information vulnerability in suppportutils of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 15 SP3 allows attackers that get access to the support logs to gain knowledge of the stored credentials This issue affects: SUSE Linux Enterprise Server 12 supportutils version 3.0.10-95.51.1CWE-312: Cleartext Storage of Sensitive Information and prior versions. SUSE Linux Enterprise Server 15 supportutils version 3.1.21-150000.5.44.1 and prior versions. SUSE Linux Enterprise Server 15 SP3 supportutils version 3.1.21-150300.7.35.15.1 and prior versions.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Opensuse	Supportutils
Suse	Linux Enterprise Server

Configuration 1 [-]

AND

cpe:2.3:a:opensuse:supportutils:*:*:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:12:-:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:a:opensuse:supportutils:*:*:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:15:-:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:a:opensuse:supportutils:*:*:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:15:sp3:*:*:*:*:*:*

No data.

References

Link	Providers
https://bugzilla.suse.com/show_bug.cgi?id=1207598

History

Tue, 18 Mar 2025 20:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: suse

Published: 2023-02-15T00:00:00.000Z

Updated: 2025-03-18T19:24:37.461Z

Reserved: 2022-11-11T00:00:00.000Z

Link: CVE-2022-45154

Vulnrichment

Updated: 2024-08-03T14:09:56.382Z

NVD

Status : Modified

Published: 2023-02-15T10:15:17.377

Modified: 2024-11-21T07:28:51.833

Link: CVE-2022-45154

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-45154", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "assignerShortName": "suse", "dateUpdated": "2025-03-18T19:24:37.461Z", "dateReserved": "2022-11-11T00:00:00.000Z", "datePublished": "2023-02-15T00:00:00.000Z"}, "containers": {"cna": {"title": "supportconfig does not remove passwords in /etc/iscsi/iscsid.conf and /etc/target/lio_setup.sh", "datePublic": "2023-01-26T00:00:00.000Z", "providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2023-02-15T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "A Cleartext Storage of Sensitive Information vulnerability in suppportutils of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 15 SP3 allows attackers that get access to the support logs to gain knowledge of the stored credentials This issue affects: SUSE Linux Enterprise Server 12 supportutils version 3.0.10-95.51.1CWE-312: Cleartext Storage of Sensitive Information and prior versions. SUSE Linux Enterprise Server 15 supportutils version 3.1.21-150000.5.44.1 and prior versions. SUSE Linux Enterprise Server 15 SP3 supportutils version 3.1.21-150300.7.35.15.1 and prior versions."}], "affected": [{"vendor": "SUSE", "product": "SUSE Linux Enterprise Server 12", "versions": [{"version": "supportutils", "status": "affected", "lessThanOrEqual": "3.0.10-95.51.1CWE-312: Cleartext Storage of Sensitive Information", "versionType": "custom"}]}, {"vendor": "SUSE", "product": "SUSE Linux Enterprise Server 15", "versions": [{"version": "supportutils", "status": "affected", "lessThanOrEqual": "3.1.21-150000.5.44.1", "versionType": "custom"}]}, {"vendor": "SUSE", "product": "SUSE Linux Enterprise Server 15 SP3", "versions": [{"version": "supportutils", "status": "affected", "lessThanOrEqual": "3.1.21-150300.7.35.15.1", "versionType": "custom"}]}], "references": [{"url": "https://bugzilla.suse.com/show_bug.cgi?id=1207598"}], "credits": [{"lang": "en", "value": "Nozomi Matsuzawa"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "LOW", "baseScore": 4.4, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-312: Cleartext Storage of Sensitive Information", "cweId": "CWE-312"}]}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "source": {"advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1207598", "defect": ["1207598"], "discovery": "INTERNAL"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T14:09:56.382Z"}, "title": "CVE Program Container", "references": [{"url": "https://bugzilla.suse.com/show_bug.cgi?id=1207598", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-18T19:24:29.999217Z", "id": "CVE-2022-45154", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-18T19:24:37.461Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://bugzilla.suse.com/show_bug.cgi?id=1207598", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T14:09:56.382Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-45154", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-18T19:24:29.999217Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-18T19:21:39.808Z"}}], "cna": {"title": "supportconfig does not remove passwords in /etc/iscsi/iscsid.conf and /etc/target/lio_setup.sh", "source": {"defect": ["1207598"], "advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1207598", "discovery": "INTERNAL"}, "credits": [{"lang": "en", "value": "Nozomi Matsuzawa"}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "SUSE", "product": "SUSE Linux Enterprise Server 12", "versions": [{"status": "affected", "version": "supportutils", "versionType": "custom", "lessThanOrEqual": "3.0.10-95.51.1CWE-312: Cleartext Storage of Sensitive Information"}]}, {"vendor": "SUSE", "product": "SUSE Linux Enterprise Server 15", "versions": [{"status": "affected", "version": "supportutils", "versionType": "custom", "lessThanOrEqual": "3.1.21-150000.5.44.1"}]}, {"vendor": "SUSE", "product": "SUSE Linux Enterprise Server 15 SP3", "versions": [{"status": "affected", "version": "supportutils", "versionType": "custom", "lessThanOrEqual": "3.1.21-150300.7.35.15.1"}]}], "datePublic": "2023-01-26T00:00:00.000Z", "references": [{"url": "https://bugzilla.suse.com/show_bug.cgi?id=1207598"}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "descriptions": [{"lang": "en", "value": "A Cleartext Storage of Sensitive Information vulnerability in suppportutils of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 15 SP3 allows attackers that get access to the support logs to gain knowledge of the stored credentials This issue affects: SUSE Linux Enterprise Server 12 supportutils version 3.0.10-95.51.1CWE-312: Cleartext Storage of Sensitive Information and prior versions. SUSE Linux Enterprise Server 15 supportutils version 3.1.21-150000.5.44.1 and prior versions. SUSE Linux Enterprise Server 15 SP3 supportutils version 3.1.21-150300.7.35.15.1 and prior versions."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-312", "description": "CWE-312: Cleartext Storage of Sensitive Information"}]}], "providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2023-02-15T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2022-45154", "state": "PUBLISHED", "dateUpdated": "2025-03-18T19:24:37.461Z", "dateReserved": "2022-11-11T00:00:00.000Z", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "datePublished": "2023-02-15T00:00:00.000Z", "assignerShortName": "suse"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:opensuse:supportutils:*:*:*:*:*:*:*:*", "matchCriteriaId": "8CA61E84-D366-4E82-A0F2-B26445610EB6", "versionEndIncluding": "3.0.10-95.51.1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:suse:linux_enterprise_server:12:-:*:*:*:*:*:*", "matchCriteriaId": "15FC9014-BD85-4382-9D04-C0703E901D7A", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:opensuse:supportutils:*:*:*:*:*:*:*:*", "matchCriteriaId": "3CA4BD70-03B8-4CBD-8532-C75BC77F3722", "versionEndIncluding": "3.1.21-150000.5.44.1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:suse:linux_enterprise_server:15:-:*:*:*:*:*:*", "matchCriteriaId": "0BB4DDAB-D900-4EC0-99E8-1D6AB48F6D20", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:opensuse:supportutils:*:*:*:*:*:*:*:*", "matchCriteriaId": "02F152EA-2162-4750-9A40-01BAD9FAF936", "versionEndIncluding": "3.1.21-150300.7.35.15.1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:suse:linux_enterprise_server:15:sp3:*:*:*:*:*:*", "matchCriteriaId": "6C2EACE6-C127-4B13-8002-8EEBEE8D549B", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "A Cleartext Storage of Sensitive Information vulnerability in suppportutils of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 15 SP3 allows attackers that get access to the support logs to gain knowledge of the stored credentials This issue affects: SUSE Linux Enterprise Server 12 supportutils version 3.0.10-95.51.1CWE-312: Cleartext Storage of Sensitive Information and prior versions. SUSE Linux Enterprise Server 15 supportutils version 3.1.21-150000.5.44.1 and prior versions. SUSE Linux Enterprise Server 15 SP3 supportutils version 3.1.21-150300.7.35.15.1 and prior versions."}, {"lang": "es", "value": "Una vulnerabilidad de almacenamiento de texto plano de informaci\u00f3n confidencial en las utilidades de soporte de SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 15 SP3 permite a los atacantes que obtienen acceso a los registros de soporte obtener conocimiento de las credenciales almacenadas. Este problema afecta a: SUSE Linux Enterprise Server 12 supportutils versi\u00f3n 3.0.10-95.51.1CWE-312: almacenamiento de texto plano de informaci\u00f3n confidencial y versiones anteriores. SUSE Linux Enterprise Server 15 supportutils versi\u00f3n 3.1.21-150000.5.44.1 y versiones anteriores. SUSE Linux Enterprise Server 15 SP3 supportutils versi\u00f3n 3.1.21-150300.7.35.15.1 y versiones anteriores."}], "id": "CVE-2022-45154", "lastModified": "2024-11-21T07:28:51.833", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 2.5, "source": "meissner@suse.de", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-02-15T10:15:17.377", "references": [{"source": "meissner@suse.de", "tags": ["Exploit", "Issue Tracking"], "url": "https://bugzilla.suse.com/show_bug.cgi?id=1207598"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Issue Tracking"], "url": "https://bugzilla.suse.com/show_bug.cgi?id=1207598"}], "sourceIdentifier": "meissner@suse.de", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-312"}], "source": "meissner@suse.de", "type": "Secondary"}]}