CVE-2022-3644
25.10.2022, 18:15
The collection remote for pulp_ansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mode via the API () instead of marking it as write only.Enginsight
| Vendor | Product | Version |
|---|---|---|
| pulpproject | pulp_ansible | - |
| redhat | ansible_automation_platform | 2.0 |
| redhat | satellite | 6.0 |
| redhat | update_infrastructure | 3.0 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-256 - Plaintext Storage of a PasswordStoring a password in plaintext may result in a system compromise.
- CWE-522 - Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.