{"id":"CVE-2022-4311","url":"https://www.cyber-defence.io/tools/cve/CVE-2022-4311","generatedAt":"2026-10-27T18:48:51.068Z","title":"An insertion of sensitive information into log file vulnerability exists in PcVue versions 15 through 15.2.2.","description":"\nAn insertion of sensitive information into log file vulnerability exists in PcVue versions 15 through 15.2.2. This\ncould allow a user with access to the log files to discover connection strings of data sources configured for the\nDbConnect, which could include credentials. Successful exploitation of this vulnerability could allow other users\nunauthorized access to the underlying data sources.\n\n","published":"2022-12-12T18:15:13.000Z","lastModified":"2026-07-09T18:32:08.000Z","status":"Modified","sourceIdentifier":"ics-cert@hq.dhs.gov","cvss":{"version":"3.1","score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},"cwe":["CWE-532"],"affected":["arcinfo/pcvue"],"epss":{"score":0.00353,"percentile":0.28765,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.35%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1165-security-bulletin-2022-6","tags":["Permissions Required","Vendor Advisory"],"source":"ics-cert@hq.dhs.gov"},{"url":"https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1165-security-bulletin-2022-6","tags":["Permissions Required","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-4311","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}