Vulnerability · Published Dec 12, 2022 · Assigned by icscert

CVE-2022-4311

Medium 4.7

In plain English

A medium-severity sensitive data in logs in PcVue from ARC Informatique. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)4.7Medium

Exploit odds (30 days)0.4%top 70.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An insertion of sensitive information into log file vulnerability exists in PcVue versions 15 through 15.2.2. This could allow a user with access to the log files to discover connection strings of data sources configured for the DbConnect, which could include credentials. Successful exploitation of this vulnerability could allow other users unauthorized access to the underlying data sources.

Affected products (as reported)

Vendor	Product	Versions
ARC Informatique	PcVue	15 – through 15.2.2

Weakness: CWE-532 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1165-security-bulletin-2022-6 vendor-advisory