Vulnerability · Published Dec 9, 2024 · Assigned by arcinfo

CVE-2024-12057User credentials recorded in log files

Low 1.8

In plain English

A low-severity sensitive data in logs in PcVue from arcinfo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).

Severity (CVSS 4.0)1.8Low

Exploit odds (30 days)0.1%top 96.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

User credentials (login & password) are inserted into log files when a user tries to authenticate using a version of a Web client that is not compatible with that of the PcVue Web back end. By exploiting this vulnerability, an attacker could retrieve the credentials of a user by accessing the Log File. Successful exploitation of this vulnerability could lead to unauthorized access to the application.

Affected products (as reported)

Vendor	Product	Versions
arcinfo	PcVue	16.0.0 – before 16.2.415.0.0 – before 15.2.11

Weakness: CWE-532 · Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/AU:N/R:U/V:C/RE:M/U:Clear

References

https://www.pcvue.com/security/#SB2024-6 vendor-advisory