Vulnerability · Published Jul 20, 2022 · Assigned by certcc
CVE-2022-1766
High 7.5
In plain English
A high-severity security flaw in Anchore Enterprise from Anchore Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).
Severity (CVSS NVD)7.5High
Exploit odds (30 days)0.7%top 46.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Anchore Enterprise anchorectl version 0.1.4 improperly stored credentials when generating a Software Bill of Materials. anchorectl will add the credentials used to access Anchore Enterprise API in the Software Bill of Materials (SBOM) generated by anchorectl. Users of anchorectl version 0.1.4 should upgrade to anchorectl version 0.1.5 to resolve this issue.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Anchore Inc. | Anchore Enterprise | unspecified – before 4.0.1 |
| Anchore Inc. | AnchoreCTL | unspecified – before 0.1.5 |
Weakness: CWE-522
References
- https://docs.anchore.com/current/docs/releasenotes/401/ x_refsource_CONFIRM