PT-2022-23510 · Unknown · Arq Backup

Sam Haskins · Published 2022-09-09 · Updated 2022-09-14 · CVE-2022-36617

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Arq Backup versions 7.19.5.0 and below

Description The issue allows attackers with administrative privileges to recover cleartext passwords because Arq Backup stores backup encryption passwords using reversible encryption.

Recommendations For Arq Backup versions 7.19.5.0 and below, consider changing the backup encryption passwords and storing them securely to prevent potential exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2022-36617

Affected Products

Arq Backup

References · 5

• https://osv.dev/vulnerability/CVE-2022-36617 · Vendor Advisory
• https://arqbackup.com/download/arqbackup/arq7windows_release_notes.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36617 · Security Note
• https://startrekdude.github.io/arqbackup.html · Note
• https://t.me/cibsecurity/49545 · Telegram Post