{"containers": {"cna": {"affected": [{"product": "PcVue 12 OAuth web service configuration", "vendor": "ARC Informatique", "versions": [{"lessThan": "12.0.27", "status": "affected", "version": "All", "versionType": "custom"}]}, {"product": "PcVue 15 OAuth web service configuration", "vendor": "ARC Informatique", "versions": [{"status": "affected", "version": "All"}]}], "credits": [{"lang": "en", "value": "An unnamed researcher reported this vulnerability to ARC Informatique."}], "datePublic": "2022-08-23T00:00:00", "descriptions": [{"lang": "en", "value": "The affected device stores sensitive information in cleartext, which may allow an authenticated user to access session data stored in the OAuth database belonging to legitimate users"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-312", "description": "CWE-312 Cleartext Storage of Sensitive Information", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-08-24T15:16:15", "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-01-0"}], "solutions": [{"lang": "en", "value": "PcVue 12: The fix is available in Maintenance release 12.0.27\nAfter installing the fix, users should update the Web Deployment Console (WDC) and re-deploy the Web Server. \nAll users using the affected component should install a patched release of the WDC and re-deploy the Web Server. This will allow the WDC to update and protect the database connection string, including clearing any sensitive information stored in the web.config file."}], "source": {"advisory": "ICSA-22-235-01", "discovery": "UNKNOWN"}, "title": "ARC Informatique PcVue", "workarounds": [{"lang": "en", "value": "ARC Informatique has identified additional steps users can apply to reduce the risk:\n\nUninstall the Web Server\nAll users not using the affected component should uninstall the web server. The OAuth web service and its configuration are part of the Web Server for PcVue. If the system does not require Web & Mobile features, then users should not install them.\nUsers should contact ARC Informatique\u2019s PcVue Solutions for assistance with the above steps.\n\nFor additional information, visit the public ARC Informatique security alert page."}, {"lang": "en", "value": "PcVue 15 does not have a fix released yet, but is in the works."}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "ics-cert@hq.dhs.gov", "DATE_PUBLIC": "2022-08-23T17:00:00.000Z", "ID": "CVE-2022-2569", "STATE": "PUBLIC", "TITLE": "ARC Informatique PcVue"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "PcVue 12 OAuth web service configuration", "version": {"version_data": [{"version_affected": "<", "version_name": "All", "version_value": "12.0.27"}]}}, {"product_name": "PcVue 15 OAuth web service configuration", "version": {"version_data": [{"version_affected": "=", "version_name": "All", "version_value": "All"}]}}]}, "vendor_name": "ARC Informatique"}]}}, "credit": [{"lang": "eng", "value": "An unnamed researcher reported this vulnerability to ARC Informatique."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The affected device stores sensitive information in cleartext, which may allow an authenticated user to access session data stored in the OAuth database belonging to legitimate users"}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-312 Cleartext Storage of Sensitive Information"}]}]}, "references": {"reference_data": [{"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-01-0", "refsource": "MISC", "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-01-0"}]}, "solution": [{"lang": "en", "value": "PcVue 12: The fix is available in Maintenance release 12.0.27\nAfter installing the fix, users should update the Web Deployment Console (WDC) and re-deploy the Web Server. \nAll users using the affected component should install a patched release of the WDC and re-deploy the Web Server. This will allow the WDC to update and protect the database connection string, including clearing any sensitive information stored in the web.config file."}], "source": {"advisory": "ICSA-22-235-01", "discovery": "UNKNOWN"}, "work_around": [{"lang": "en", "value": "ARC Informatique has identified additional steps users can apply to reduce the risk:\n\nUninstall the Web Server\nAll users not using the affected component should uninstall the web server. The OAuth web service and its configuration are part of the Web Server for PcVue. If the system does not require Web & Mobile features, then users should not install them.\nUsers should contact ARC Informatique\u2019s PcVue Solutions for assistance with the above steps.\n\nFor additional information, visit the public ARC Informatique security alert page."}, {"lang": "en", "value": "PcVue 15 does not have a fix released yet, but is in the works."}]}}}, "cveMetadata": {"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2022-2569", "datePublished": "2022-08-23T00:00:00", "dateReserved": "2022-07-28T00:00:00", "dateUpdated": "2022-08-24T15:16:15", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:arcinformatique:pcvue:*:*:*:*:*:*:*:*", "matchCriteriaId": "0A2EA2CE-971E-4267-9503-771CEA1205CE", "versionEndExcluding": "12.0.27", "vulnerable": true}, {"criteria": "cpe:2.3:a:arcinformatique:pcvue:*:*:*:*:*:*:*:*", "matchCriteriaId": "51A06B7D-3E27-4F4A-838F-59523C12A88B", "versionEndIncluding": "15.2.2", "versionStartIncluding": "15", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The affected device stores sensitive information in cleartext, which may allow an authenticated user to access session data stored in the OAuth database belonging to legitimate users"}, {"lang": "es", "value": "El dispositivo afectado almacena informaci\u00f3n confidencial en texto sin cifrar, lo que puede permitir a un usuario autenticado acceder a los datos de sesi\u00f3n almacenados en la base de datos OAuth que pertenecen a usuarios leg\u00edtimos"}], "id": "CVE-2022-2569", "lastModified": "2022-08-30T19:03:35.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}, "published": "2022-08-24T16:15:11.907", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Patch", "Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-01-0"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-312"}], "source": "ics-cert@hq.dhs.gov", "type": "Primary"}]}

{}