CVE-2022-2569 - ARC Informatique PcVue

Back Back to CVE browser

MEDIUM

ARC Informatique PcVue

Published Aug 24, 2022

5.5

MEDIUM

CVSS 3.1

EPSS 0.14%

Description

The affected device stores sensitive information in cleartext, which may allow an authenticated user to access session data stored in the OAuth database belonging to legitimate users

Affected products

Vendor ARC Informatique Product PcVue 12 OAuth web service configuration Default
n/a
- Version
  All
  Status
  affected
  Constraints
  <12.0.27
Vendor ARC Informatique Product PcVue 15 OAuth web service configuration Default
n/a
- Version
  All
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

ARC Informatique

PcVue 12 OAuth web service configuration

n/a

Version	Status	Constraints
All	affected	<12.0.27

ARC Informatique

PcVue 15 OAuth web service configuration

n/a

Version	Status	Constraints
All	affected	-

Remediation

Vendor solution

PcVue 12: The fix is available in Maintenance release 12.0.27 After installing the fix, users should update the Web Deployment Console (WDC) and re-deploy the Web Server. All users using the affected component should install a patched release of the WDC and re-deploy the Web Server. This will allow the WDC to update and protect the database connection string, including clearing any sensitive information stored in the web.config file.

Weaknesses (1)

CWE-312

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-34822
Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-01-0
x_refsource_MISCPatchThird Party AdvisoryUS Government Resource

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-34822		Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-01-0		x_refsource_MISCPatchThird Party AdvisoryUS Government Resource