CWE-522

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/aquasecurity/trivy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.51.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-35192"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-522"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-20T20:36:53Z",
    "nvd_published_at": "2024-05-20T21:15:09Z",
    "severity": "MODERATE"
  },
  "details": "## Impact\nIf a malicious actor is able to trigger Trivy to scan container images from a crafted malicious registry, it could result in the leakage of credentials for legitimate registries such as AWS Elastic Container Registry (ECR), Google Cloud Artifact/Container Registry, or Azure Container Registry (ACR). These tokens can then be used to push/pull images from those registries to which the identity/user running Trivy has access.\n\nTaking AWS as an example, the leakage only occurs when Trivy is able to transparently obtain registry credentials from the default [credential provider chain](https://aws.github.io/aws-sdk-go-v2/docs/configuring-sdk/#specifying-credentials). You are affected if Trivy is executed in any of the following situations:\n\n- The environment variables contain static AWS credentials (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN) that have access to ECR.\n- Within a Pod running on an EKS cluster that has been assigned a role with access to ECR using an [IAM Roles for Service Accounts](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html) (IRSA) annotation.\n- etc.\n\nYou are not affected if the default credential provider chain is unable to obtain valid credentials. The same applies to GCP and Azure.\n\n## Workarounds\nIf you are using Trivy v0.51.2 or later, you are not affected. If you are using Trivy v0.51.1 or prior, you should ensure you only scan images from trusted registries.\n\nThis vulnerability only applies when scanning container images directly from a registry. If you use Docker, containerd or other runtime to pull images locally and scan them with Trivy, you are not affected. To enforce this behavior, you can use the `--image-src` flag to select which sources you trust. \n",
  "id": "GHSA-xcq4-m2r3-cmrj",
  "modified": "2024-05-20T22:07:21Z",
  "published": "2024-05-20T20:36:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/aquasecurity/trivy/security/advisories/GHSA-xcq4-m2r3-cmrj"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35192"
    },
    {
      "type": "WEB",
      "url": "https://github.com/aquasecurity/trivy/commit/e7f14f729de259551203f313e57d2d9d3aa2ff87"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/aquasecurity/trivy"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Trivy possibly leaks registry credential when scanning images from malicious registries"
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-8632"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-521",
      "CWE-522"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-02-05T14:15:00Z",
    "severity": "LOW"
  },
  "details": "In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default pwlen value, which makes it easier for attackers to guess passwords.",
  "id": "GHSA-xcwr-9f5c-qg65",
  "modified": "2022-05-24T17:08:06Z",
  "published": "2022-05-24T17:08:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8632"
    },
    {
      "type": "WEB",
      "url": "https://github.com/canonical/cloud-init/pull/189"
    },
    {
      "type": "WEB",
      "url": "https://bugs.launchpad.net/ubuntu/+source/cloud-init/+bug/1860795"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2020/02/msg00021.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00042.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-5922"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-522"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-29T17:15:33Z",
    "severity": "MODERATE"
  },
  "details": "Access to TSplus Remote Access Admin Tool\u00a0is restricted to administrators (unless \"Disable UAC\" option is enabled) and requires a PIN code. In versions\u00a0below\u00a0v18.40.6.17\u00a0the PIN\u0027s hash is stored in a system registry accessible to regular users, making it possible to perform a brute-force attack using rainbow tables, since the hash is not salted.\nLTS (Long-Term Support) versions also received patches in\u00a0v17.2025.6.27 and\u00a0v16.2025.6.27 releases.",
  "id": "GHSA-xfj9-9qw7-7cmr",
  "modified": "2025-07-29T18:30:35Z",
  "published": "2025-07-29T18:30:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5922"
    },
    {
      "type": "WEB",
      "url": "https://cert.pl/en/posts/2025/07/CVE-2025-5922"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-25407"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-522"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-04-11T21:15:00Z",
    "severity": "HIGH"
  },
  "details": "Aten PE8108 2.4.232 is vulnerable to Incorrect Access Control. Restricted users have read access to administrator credentials.",
  "id": "GHSA-xfx8-2v9j-75g4",
  "modified": "2025-02-11T18:31:11Z",
  "published": "2023-04-11T21:31:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25407"
    },
    {
      "type": "WEB",
      "url": "https://www.pentagrid.ch/en/blog/multiple-vulnerabilities-in-aten-PE8108-power-distribution-unit"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-22557"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-256",
      "CWE-287",
      "CWE-522"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-06-02T21:15:00Z",
    "severity": "HIGH"
  },
  "details": "PowerStore contains Plain-Text Password Storage Vulnerability in PowerStore X \u0026 T environments running versions 2.0.0.x and 2.0.1.x A locally authenticated attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account.",
  "id": "GHSA-xfxv-hqvj-fpfc",
  "modified": "2022-06-14T00:00:29Z",
  "published": "2022-06-03T00:00:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22557"
    },
    {
      "type": "WEB",
      "url": "https://www.dell.com/support/kbdoc/000196367"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-6242"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-522"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-02-08T05:29:00Z",
    "severity": "HIGH"
  },
  "details": "** DISPUTED ** Kentico v10.0.42 allows Global Administrators to read the cleartext SMTP Password by navigating to the SMTP configuration page. NOTE: the vendor considers this a best-practice violation but not a vulnerability. The vendor plans to fix it at a future time.",
  "id": "GHSA-xggx-rf7g-q3f6",
  "modified": "2022-05-13T01:22:39Z",
  "published": "2022-05-13T01:22:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-6242"
    },
    {
      "type": "WEB",
      "url": "https://gist.github.com/boatpavaris/cff51e52a96fdde8215f71a3315703c2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-11885"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-522"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-05-12T14:29:00Z",
    "severity": "MODERATE"
  },
  "details": "eyeDisk implements the unlock feature by sending a cleartext password. The password can be discovered by sniffing USB traffic or by sending a 06 05 52 41 01 b0 00 00 00 00 00 00 SCSI command.",
  "id": "GHSA-xhx6-jqvp-55rr",
  "modified": "2024-04-04T00:35:48Z",
  "published": "2022-05-24T16:45:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11885"
    },
    {
      "type": "WEB",
      "url": "https://www.pentestpartners.com/security-blog/eyedisk-hacking-the-unhackable-again"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.jenkins-ci.plugins:eggplant-plugin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2019-10385"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-522"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-30T21:20:20Z",
    "nvd_published_at": "2019-08-07T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Jenkins eggPlant Plugin 2.2 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.",
  "id": "GHSA-xj63-95xc-jc4v",
  "modified": "2024-01-30T21:20:20Z",
  "published": "2022-05-24T16:52:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10385"
    },
    {
      "type": "WEB",
      "url": "https://jenkins.io/security/advisory/2019-08-07/#SECURITY-1430"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-19-834"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2019/08/07/1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Jenkins eggplant-plugin Plugin stores credentials in plain text "
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/rancher/rancher"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.9.0"
            },
            {
              "fixed": "2.9.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/rancher/rancher"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.7.0"
            },
            {
              "fixed": "2.8.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-45157"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-522"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-10-25T19:35:55Z",
    "nvd_published_at": "2024-11-13T14:15:14Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nA vulnerability has been identified in the way that Rancher stores vSphere\u0027s CPI (Cloud Provider Interface) and CSI (Container Storage Interface) credentials used to deploy clusters through the vSphere cloud provider. This issue leads to the vSphere CPI and CSI passwords being stored in a plaintext object inside Rancher. This vulnerability is only applicable to users that deploy clusters in vSphere environments.\n\nThe exposed passwords were accessible in the following objects:\n\n- Can be accessed by users that are cluster members of the provisioned clusters:\n  - When provisioning a new cluster with the vSphere cloud provider through Rancher\u0027s UI (user interface), Cluster Templates and Terraform on the object `provisioning.cattle.io` in `spec.rkeConfig.chartValues.rancher-vsphere-cpi` and `spec.rkeConfig.chartValues.rancher-vsphere-csi`.\n  - On the object `rke.cattle.io.rkecontrolplane` in `spec.chartValues.rancher-vsphere-cpi` and `spec.chartValues.rancher-vsphere-csi`.\n- Can be accessed by users with privileged access to the clusters\u0027 infrastructure (host OS):\n  - Inside the `plan` files in the provisioned downstream clusters\u0027 filesystems.\n\n**Note:** if you believe that the vSphere credentials might have been accessed by unauthorized users, it\u0027s highly recommended to change them, after updating Rancher to a patched version.\n\nPlease consult the associated  [MITRE ATT\u0026CK - Technique -  Credential Access](https://attack.mitre.org/tactics/TA0006/) for further information about this category of attack.\n\n### Patches\n\nPatched versions include Rancher releases **2.8.9 and 2.9.3**.\n\nAfter updating your environment to one of the patched Rancher\u0027s versions, it\u0027s mandatory to execute [this script](https://github.com/rancherlabs/support-tools/tree/master/migrate-vsphere-clusters) that provides an automated way to mitigate any vulnerable leftover vSphere clusters\u0027 credentials within Rancher\u0027s local cluster. This script doesn\u0027t need to be executed in case you are installing a fresh and new environment.\n\nThe script will fetch all objects in Rancher\u0027s local cluster,  loops through them, if the affected vSphere charts are present, then it extracts the `username` and `password` parameters into a secret in the `fleet-default` namespace for both with the appropriate annotation to synchronize them to the downstream clusters. Finally, it updates the cluster\u0027s `chartValues` to reference those secrets rather than existing plaintext values.\n\nThe script confirms on write operations, as well as backs up configurations of the cluster objects before operating so rolling back is simple.\n\nTo run the script, fetch the `kubeconfig` for your local cluster and run with `KUBECONFIG=/path/to/kubeconfig.yml bash migrate.sh`. The script is idempotent and can be run multiple times safely if you want to validate just one at a time.\n\n**Notes:**\n\n- The [feature flag](https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/installation-references/feature-flags) `provisioningprebootstrap` must be enabled after updating to one of the patched versions. This feature flag is also mandatory when installing a new cluster.\n- **Rancher 2.7 release line is not receiving a backport security patch for this vulnerability.** For users running Rancher 2.7 with vSphere provisioning and that are concerned with this security issue, the recommendation is to update Rancher to one of the patched versions by following the standard update procedure based on the 2.7 version that is being used. Refer to the release notes for the proper update process for [2.8.9](https://github.com/rancher/rancher/releases/tag/v2.8.9) and [2.9.3](https://github.com/rancher/rancher/releases/tag/v2.9.3).\n\n### Workarounds\n\nBesides only granting access to Rancher to trusted users and not allowing direct access to untrusted users to the clusters\u0027 infrastructure, there is no direct workaround for this security issue, except updating Rancher to one of the patched versions.\n\n### References\n\nIf you have any questions or comments about this advisory:\n- Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.\n- Open an issue in the [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository.\n- Verify with our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).\n",
  "id": "GHSA-xj7w-r753-vj8v",
  "modified": "2024-11-13T16:29:20Z",
  "published": "2024-10-25T19:35:55Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rancher/rancher/security/advisories/GHSA-xj7w-r753-vj8v"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45157"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2022-45157"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rancher/rancher"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Exposure of vSphere\u0027s CPI and CSI credentials in Rancher"
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-7196"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-522"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-10-26T16:15:00Z",
    "severity": "MODERATE"
  },
  "details": "The HPE BlueData EPIC Software Platform version 4.0 and HPE Ezmeral Container Platform 5.0 use an insecure method of handling sensitive Kerberos passwords that is susceptible to unauthorized interception and/or retrieval. Specifically, they display the kdc_admin_password in the source file of the url \"/bdswebui/assignusers/\".",
  "id": "GHSA-xjcx-2qxv-xf7v",
  "modified": "2022-05-24T17:32:12Z",
  "published": "2022-05-24T17:32:12Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7196"
    },
    {
      "type": "WEB",
      "url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbgn04049en_us"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}