CVE-2022-4311

low-risk

Published 2022-12-12

An insertion of sensitive information into log file vulnerability exists in PcVue versions 15 through 15.2.2. This could allow a user with access to the log files to discover connection strings of data sources configured for the DbConnect, which could include credentials. Successful exploitation of this vulnerability could allow other users unauthorized access to the underlying data sources.

Do I need to act?

0.36% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 4.7/10 Medium

LOCAL / HIGH complexity

Affected Products (1)

Pcvue

Affected Vendors

Arcinformatique

References (2)

Permissions Required https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1165-secur...

/ 100

low-risk

Severity 12/34 · Low

Exploitability 1/34 · Minimal

Exposure 5/34 · Minimal