CVE-2022-23715

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A flaw was discovered in ECE before 3.4.0 that might lead to the disclosure of sensitive information such as user passwords and Elasticsearch keystore settings values in logs such as the audit log or deployment logs in the Logging and Monitoring cluster. The affected APIs are PATCH /api/v1/user and PATCH /deployments/{deployment_id}/elasticsearch/{ref_id}/keystore

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-532

Affected software

No affected versions have been published.

Timeline

Published: Aug 25, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-237165.3A flaw was discovered in ECE before 3.1.1 that could lead to the disclosure of the SAML signing private key used for the RBAC features, in d CVE-2022-237175.5PingID Windows Login prior to 2.8 is vulnerable to a denial of service condition on local machines when combined with using offline security CVE-2022-237188.1PingID Windows Login prior to 2.8 uses known vulnerable components that can lead to remote code execution. An attacker capable of achieving CVE-2022-237196.4PingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requests. An at CVE-2022-23724.8The YaySMTP WordPress plugin before 2.2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as CVE-2022-237208.2PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties fi CVE-2022-237213.3PingID integration for Windows login prior to 2.9 does not handle duplicate usernames, which can lead to a username collision when two peopl CVE-2022-237226.5When a password reset mechanism is configured to use the Authentication API with an Authentication Policy, email One-Time Password, PingID o CVE-2022-237237.7An MFA bypass vulnerability exists in the PingFederate PingOne MFA Integration Kit when adapter HTML templates are used as part of an authen CVE-2022-237248.1Use of static encryption key material allows forging an authentication token to other users within a tenant organization. MFA may be bypasse CVE-2022-237255.5PingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under s CVE-2022-237264.9PingCentral versions prior to listed versions expose Spring Boot actuator endpoints that with administrative authentication return large amo