PT-2022-16947 · Unknown · Cveproject/Cve-Services

Jdaigneau5 · Published 2022-04-21 · Updated 2022-05-03 · CVE-2022-24875

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions CVEProject/cve-services versions up to and including 1.1.1

Description The issue concerns the erroneous logging of user secrets in the org.conroller.js code. This problem has been resolved in commit 46d98f2b and will be available in subsequent versions of the software. Users are advised to inspect their logs and remove any logged secrets as necessary.

Recommendations For versions up to and including 1.1.1, manually apply the 46d98f2b commit to resolve the issue. As a temporary workaround, inspect logs and remove logged secrets as appropriate. Update to a subsequent version of the software when it becomes available.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2022-24875

GHSA-RHJ9-QX37-7M2M

Affected Products

Cveproject/Cve-Services

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24875.json · Exploit
• 🔥 https://github.com/CVEProject/cve-services/commit/46d98f2b1427fc6ba1c2bc443dc6688fd400f1f4 · Exploit
• 🔥 https://github.com/CVEProject/cve-services/security/advisories/GHSA-rhj9-qx37-7m2m · Exploit
• https://osv.dev/vulnerability/CVE-2022-24875 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24875 · Security Note
• https://t.me/cibsecurity/41254 · Telegram Post