PT-2022-7096 · Pcvue · Pcvue

Arc Informatique · Published 2022-12-12 · Updated 2022-12-15 · CVE-2022-4311

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions PcVue versions 15 through 15.2.2

Description An issue exists where sensitive information is inserted into log files, potentially allowing users with access to these logs to discover connection strings of data sources configured for the DbConnect, which could include credentials. This could lead to unauthorized access to the underlying data sources.

Recommendations For PcVue versions 15 through 15.2.2, consider restricting access to log files to minimize the risk of sensitive information disclosure until a patch is available. As a temporary workaround, limit the use of the DbConnect feature to reduce the exposure of credentials. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

BDU:2023-07571

CVE-2022-4311

Affected Products

Pcvue

References · 7

• https://bdu.fstec.ru/vul/2023-07571 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-4311 · Security Note
• https://pcvuesolutions.com/support/index.php/en/security-bulletin/1165-security-bulletin-2022-6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-4311 · Vendor Advisory
• https://cisa.gov/uscert/ics/advisories/icsa-22-354-03 · Note
• https://t.me/cibsecurity/54342 · Telegram Post
• https://t.me/cvenotify/39965 · Telegram Post