CVE-2022-3644

CWE-256CWE-522 — Insufficiently Protected Credentials5 documents5 sources
Severity
5.5MEDIUM
EPSS
0.0%
top 85.76%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Redhat Ansible Automation PlatformRedhat SatelliteRedhat Update Infrastructure
Timeline
PublishedOct 25

Description

The collection remote for pulp_ansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mode via the API () instead of marking it as write only.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages5 packages

▶PyPIpulp-ansible< 0.15.0
▶CVEListV5pulp_ansible0.15

🔴Vulnerability Details

3
OSV
Plaintext storage of tokens in pulp_ansible↗2022-10-25
▶
CVEList
CVE-2022-3644: The collection remote for pulp_ansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mode via the↗2022-10-25
▶
GHSA
Plaintext storage of tokens in pulp_ansible↗2022-10-25
▶

📋Vendor Advisories

1
Red Hat
Pulp: Tokens stored in plaintext↗2022-10-04
▶