CVE-2022-1662

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In convert2rhel, there's an ansible playbook named ansible/run-convert2rhel.yml which passes the Red Hat Subscription Manager user password via the CLI to convert2rhel. This could allow unauthorized local users to view the password via the process list while convert2rhel is running. However, this ansible playbook is only an example in the upstream repository and it is not shipped in officially supported versions of convert2rhel.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Jul 14, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-16636.5The Stop Spam Comments WordPress plugin through 0.2.1.2 does not properly generate the Javascript access token for preventing abuse of commeCVE-2022-16649.8Dpkg::Source::Archive in dpkg, the Debian package management system, before version 1.21.8, 1.20.10, 1.19.8, 1.18.26 is prone to a directoryCVE-2022-16658.2A set of pre-production kernel packages of Red Hat Enterprise Linux for IBM Power architecture can be booted by the grub in Secure Boot modeCVE-2022-16666.5The default password for the web application’s root user (the vendor’s private account) was weak and the MD5 hash was used to crack the passCVE-2022-16677.5Client-side JavaScript controls may be bypassed by directly running a JS function to reboot the PLC (e.g., from the browser console) or by lCVE-2022-16689.8Weak default root user credentials allow remote attackers to easily obtain OS superuser privileges over the open TCP port for SSH.CVE-2022-16698.1A buffer overflow vulnerability has been detected in the firewall function of the device management web portal. The device runs a CGI binaryCVE-2022-16707.5When generating a user invitation code in Octopus Server, the validity of this code can be set for a specific number of users. It was possibCVE-2022-16717.1A NULL pointer dereference flaw was found in rxrpc_preparse_s in net/rxrpc/server_key.c in the Linux kernel. This flaw allows a local attackCVE-2022-16728.8The Insights from Google PageSpeed WordPress plugin before 4.0.7 does not verify for CSRF before doing various actions such as deleting CustCVE-2022-16736.1The WooCommerce Green Wallet Gateway WordPress plugin before 1.0.2 does not escape the error_envision query parameter before outputting it tCVE-2022-16745.5NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 in GitHub repository vim/vim prior to 8.2.4938. NULL Pointer Derefe
CVE-2022-1662: Medium severity, CVSS 5.5 | Vulnix