CVE-2022-27888

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Foundry Issues service versions 2.244.0 to 2.249.0 was found to be logging in a manner that captured sensitive information (session tokens). This issue was fixed in 2.249.1.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-532

Affected software

No affected versions have been published.

Timeline

Published
Apr 26, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-278899.1The Multipass service was found to have code paths that could be abused to cause a denial of service for authentication or authorization opeCVE-2022-27895.5Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulnerable to CWE-345 Insufficient Verification of Data Authenticity, aCVE-2022-278907.4It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactoryCVE-2022-278915.3Palantir Gotham included an unauthenticated endpoint that listed all active usernames on the stack with an active session. The affected servCVE-2022-278927.5Palantir Gotham versions prior to 3.22.11.2 included an unauthenticated endpoint that would have allowed an attacker to exhaust the memory oCVE-2022-278934.2The Foundry Magritte plugin osisoft-pi-web-connector versions 0.15.0 - 0.43.0 was found to be logging in a manner that captured authenticatiCVE-2022-278945.4The Foundry Blobster service was found to have a cross-site scripting (XSS) vulnerability that could have allowed an attacker with access toCVE-2022-278957.5Information Exposure Through Log Files vulnerability discovered in Foundry when logs were captured using an underlying library known as BuilCVE-2022-278967.5Information Exposure Through Log Files vulnerability discovered in Foundry Code-Workbooks where the endpoint backing that console was generaCVE-2022-278977.5Palantir Gotham versions prior to 3.22.11.2 included an unauthenticated endpoint that would load portions of maliciously crafted zip files tCVE-2022-27905.9Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-347 Improper Verification of Cryptographic Signature,CVE-2022-279038.8An OS Command Injection vulnerability in the configuration parser of Eve-NG Professional through 4.0.1-65 and Eve-NG Community through 2.0.3
CVE-2022-27888: Medium severity, CVSS 5.5 | Vulnix