CVE-2022-45154

supportconfig does not remove passwords in /etc/iscsi/iscsid.conf and /etc/target/lio_setup.sh

State: Published
Severity: 4.4 Medium
Published: Feb 15, 2023
Updated: Mar 18, 2025
Reserved: Nov 11, 2022

Description

A Cleartext Storage of Sensitive Information vulnerability in suppportutils of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 15 SP3 allows attackers that get access to the support logs to gain knowledge of the stored credentials This issue affects: SUSE Linux Enterprise Server 12 supportutils version 3.0.10-95.51.1CWE-312: Cleartext Storage of Sensitive Information and prior versions. SUSE Linux Enterprise Server 15 supportutils version 3.1.21-150000.5.44.1 and prior versions. SUSE Linux Enterprise Server 15 SP3 supportutils version 3.1.21-150300.7.35.15.1 and prior versions.

Scores

CVSS	Score	Vector	Source
3.1	4.4 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L	suse

Weaknesses

CWE-312 Cleartext Storage of Sensitive Information

Affected Products

Product	Versions
SUSE Linux Enterprise Server 12SUSE	supportutils through 3.0.10-95.51.1CWE-312: Cleartext Storage of Sensitive InformationAffected
SUSE Linux Enterprise Server 15SUSE	supportutils through 3.1.21-150000.5.44.1Affected
SUSE Linux Enterprise Server 15 SP3SUSE	supportutils through 3.1.21-150300.7.35.15.1Affected

References

https://bugzilla.suse.com/show_bug.cgi?id=1207598

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.