CVE-2022-2084
Assigner: canonical
Published: 2023-04-19T21:47:41.034Z
State: PUBLISHED
affected: collectionURL: https://github.com/canonical/cloud-init/releases
packageName: cloud-init
platforms: Linux
product: cloud-init
repo: https://github.com/canonical/cloud-init/
vendor: Canonical Ltd.
versions: lessThan: 23.0
status: affected
version: 0
versionType: semver
credits: type: finder
value: Mike Stroyan
datePublic: 2022-06-29T22:00:00.000Z
descriptions: value: Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords.
metrics: cvssV3_1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
format: CVSS
problemTypes: descriptions: cweId: CWE-532
description: CWE-532
type: CWE
title: sensitive data exposure in cloud-init logs