VulnerabilityModified
CVE-2022-22396
Credentials could be the remote vSnap, offload targets, or VADP credentials depending on the operation performed.
HIGH 7.5EPSS 0.69%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.69%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Credentials are printed in clear text in the IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.3 virgo log file in certain cases. Credentials could be the remote vSnap, offload targets, or VADP credentials depending on the operation performed. Credentials that are using API key or certificate are not printed. IBM X-Force ID: 222231.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.69% probability · 51th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-522
- Affected
- ibm/spectrum protect plus
- Source
- psirt@us.ibm.com
References
- https://exchange.xforce.ibmcloud.com/vulnerabilities/222231VDB Entry, Vendor Advisory
- https://www.ibm.com/support/pages/node/6591505Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/222231VDB Entry, Vendor Advisory
- https://www.ibm.com/support/pages/node/6591505Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.