CVE-2022-3644

Summary

The collection remote for pulp_ansible stores tokens in plaintext instead of using pulp's encrypted field and exposes them in read/write mode via the API () instead of marking it as write only.

Affected Software

Weaknesses

• CWE-256: CWE-256

ADP Enrichment

CVE Program Container

Additional References

• https://github.com/pulp/pulp_ansible/blob/main/pulp_ansible/app/models.py#L234

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

References

• https://github.com/pulp/pulp_ansible/blob/main/pulp_ansible/app/models.py#L234

• ←Previous
• Next→