Vulnerability · Published Aug 24, 2022 · Assigned by icscert
CVE-2022-2569ARC Informatique PcVue
Medium 5.5
In plain English
A medium-severity security flaw in PcVue 12 OAuth web service configuration from ARC Informatique. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).
Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.1%top 96.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The affected device stores sensitive information in cleartext, which may allow an authenticated user to access session data stored in the OAuth database belonging to legitimate users
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ARC Informatique | PcVue 12 OAuth web service configuration | All – before 12.0.27 |
| ARC Informatique | PcVue 15 OAuth web service configuration | All |
Weakness: CWE-312 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-01-0 x_refsource_MISC