CVE-2022-29550
 
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
An issue was discovered in Qualys Cloud Agent 4.8.0-49. It writes "ps auxwwe" output to the /var/log/qualys/qualys-cloud-agent-scan.log file. This may, for example, unexpectedly write credentials (from environment variables) to disk in cleartext. NOTE: there are no common circumstances in which qualys-cloud-agent-scan.log can be read by a user other than root; however, the file contents could be exposed through site-specific operational practices. The vendor does NOT characterize this as a vulnerability because the ps data collection is intentional, and would only capture credentials on a machine that was already affected by the CWE-214 weakness
** EN DISPUTA ** Se ha detectado un problema en Qualys Cloud Agent versión 4.8.0-49. Escribe la salida "ps auxwwe" en el archivo /var/log/qualys/qualys-cloud-agent-scan.log. Esto puede, por ejemplo, escribir inesperadamente las credenciales (de las variables de entorno) en el disco en texto sin cifrar. NOTA: no se presentan circunstancias comunes en las que qualys-cloud-agent-scan.log pueda ser leído por un usuario que no sea root; sin embargo, el contenido del archivo podría estar expuesto mediante prácticas operativas específicas del sitio. El proveedor NO caracteriza esto como una vulnerabilidad porque la recolección de datos ps es intencional, y sólo capturaría credenciales en una máquina que ya estuviera afectada por la debilidad CWE-214.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-04-21 CVE Reserved
- 2022-08-18 CVE Published
- 2023-03-08 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-532: Insertion of Sensitive Information into Log File
CAPEC
References (4)
URL | Tag | Source |
---|---|---|
http://packetstormsecurity.com/files/168367/Qualys-Cloud-Agent-Arbitrary-Code-Execution.html | Third Party Advisory | |
http://seclists.org/fulldisclosure/2022/Sep/10 | Mailing List |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Qualys Search vendor "Qualys" | Cloud Agent Search vendor "Qualys" for product "Cloud Agent" | 4.8.0-49 Search vendor "Qualys" for product "Cloud Agent" and version "4.8.0-49" | linux |
Affected
|