CVE-2022-2569
mediumPriorität · verfolgen · 22OT-Risiko · erhöhtEPSS 0.001 · 3. PerzentilEUUSEPSS · bewertet 2026-10-27
The affected device stores sensitive information in cleartext, which may allow an authenticated user to access session data stored in the OAuth database belonging to legitimate users
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Noch kein Hersteller-Fix; eine Mitigation ist verfügbar.
- MitigationPcVue 12 OAuth web service configurationcisa_csaf_ot
After installing either fix, ARC Informatique recommends doing the following: After installing the fix, users should update the Web Deployment Console (WDC) and re-deploy the Web Server. All users using the affected component should install a patched release of the WDC and re-deploy the Web Server. This will allow the WDC to update and protect the database connection string, including clearing any sensitive information stored in the web.config file. After installing the fix, users should update the Web Deployment Console (WDC) and re-deploy the Web Server. All users using the affected component should install a patched release of the WDC and re-deploy the Web Server. This will allow the WDC to update and protect the database connection string, including clearing any sensitive information stored in the web.config file.
- MitigationPcVue 15 OAuth web service configurationcisa_csaf_ot
After installing either fix, ARC Informatique recommends doing the following: After installing the fix, users should update the Web Deployment Console (WDC) and re-deploy the Web Server. All users using the affected component should install a patched release of the WDC and re-deploy the Web Server. This will allow the WDC to update and protect the database connection string, including clearing any sensitive information stored in the web.config file. After installing the fix, users should update the Web Deployment Console (WDC) and re-deploy the Web Server. All users using the affected component should install a patched release of the WDC and re-deploy the Web Server. This will allow the WDC to update and protect the database connection string, including clearing any sensitive information stored in the web.config file.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (12)
Betroffene Produkte und Versionsbereiche.
Advisories (1)
Hersteller- und Ökosystem-Meldungen dazu.
- ICSA-22-235-01ARC Informatique PcVue (Update A)2022-08-23icsa · cisa_csaf_otUS
Successful exploitation of this vulnerability could allow an attacker to access the OAuth web service database.
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (6)
Externe Belege — Patches, Meldungen, Analysen.
- https://cxsecurity.com/cveshow/CVE-2022-2569/cnnvd
- https://support.pcvuesolutions.com/Patchcnnvd
- https://us-cert.cisa.gov/ics/advisories/icsa-22-235-01-0cnnvd
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-01-0cnnvd
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-01-0enisa_euvd
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-01-0PatchThird Party AdvisoryUS Government Resourcenvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan