Inclusion of Sensitive Information in Log Files in vCenter Server - CVE-2022-31697
Published: December 9, 2022
Vulnerability identifier: #VU70079
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-31697
CWE-ID: CWE-532
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to software stores credentials in plain text into log files. A local user with access to a workstation that invoked a vCenter Server Appliance ISO operation (Install/Upgrade/Migrate/Restore) can access plaintext passwords used during that operation.
Affected software
vCenter Server
IBM Cloud Pak System
PowerFlex Appliance
PowerFlex rack
IBM Cloud Pak System
PowerFlex Appliance
PowerFlex rack
How to mitigate CVE-2022-31697
Install updates from vendor's website.
vCenter Server - addressed in versions 6.5 U3u, 6.7 U3s, 7.0 U3i
IBM Cloud Pak System - update to 2.3.3.6
PowerFlex Appliance - update to IC 38.363.02
PowerFlex rack - update to 3.6.3.2
IBM Cloud Pak System - update to 2.3.3.6
PowerFlex Appliance - update to IC 38.363.02
PowerFlex rack - update to 3.6.3.2