PT-2022-20451 · Cveproject · Cve-Services

Slubar · Published 2022-05-25 · Updated 2022-06-10 · CVE-2022-31004

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions CVEProject/cve-services versions prior to 1.1.1 CVEProject/cve-services versions 2.x

Description The issue concerns a conditional in 'data.js' that may write production secrets to disk. Specifically, the method writes a generated randomKey to disk if the environment is not development. This could potentially expose the plaintext key if the method is called in production.

Recommendations For version 1.1.1, a "hot fix" patch is anticipated, and users should apply this patch once available. For the 2.x branch, a "hot fix" patch is anticipated, and users should apply this patch once available. As a temporary workaround, consider restricting the execution of the affected method in production environments to minimize the risk of secrets being written to disk.

Exploit

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-779

CWE-312

Related Identifiers

CVE-2022-31004

GHSA-MPWM-RMQP-7629

Affected Products

Cve-Services

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31004.json · Exploit
• 🔥 https://github.com/CVEProject/cve-services/blob/6b085e481fd3b084a8828ef7489c6b82fa415c92/src/utils/data.js#L68-L83 · Exploit
• 🔥 https://github.com/CVEProject/cve-services/security/advisories/GHSA-mpwm-rmqp-7629 · Exploit
• https://osv.dev/vulnerability/CVE-2022-31004 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31004 · Security Note