CVE-2023-1786
Assigner: canonical
Published: 2023-04-26T22:23:47.305Z
State: PUBLISHED
affected: collectionURL: https://github.com/canonical/cloud-init/releases
packageName: cloud-init
platforms: Linux
product: cloud-init
repo: https://github.com/canonical/cloud-init/
vendor: Canonical Ltd.
versions: lessThan: 23.1.2
status: affected
version: 0
versionType: semver
credits: type: finder
value: James Golovich
datePublic: 2023-04-26T00:00:00.000Z
descriptions: value: Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escalate their privilege.
metrics: cvssV3_1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
format: CVSS
problemTypes: descriptions: cweId: CWE-532
description: CWE-532
type: CWE
title: sensitive data exposure in cloud-init logs