CVE-2022-29550: Medium severity qualys cloud agent vulnerability
DISPUTED An issue was discovered in Qualys Cloud Agent 4.8.0-49. It writes "ps auxwwe" output to the /var/log/qualys/qualys-cloud-agent-scan.log file. This may, for example, unexpectedly write credentials (from environment variables) to disk in cleartext. NOTE: there are no common circumstances in which qualys-cloud-agent-scan.log can be read by a user other than root; however, the file contents could be exposed through site-specific operational practices. The vendor does NOT characterize this as a vulnerability because the ps data collection is intentional, and would only capture credentials on a machine that was already affected by the CWE-214 weakness.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue in Qualys Cloud Agent?
The vulnerability ID for this issue in Qualys Cloud Agent is CVE-2022-29550.
What is the severity level of CVE-2022-29550?
CVE-2022-29550 has a severity level of medium with a CVSS score of 5.5.
What is the affected software version of CVE-2022-29550?
The affected software version of CVE-2022-29550 is Qualys Cloud Agent 4.8.0-49.
What is the impact of CVE-2022-29550?
CVE-2022-29550 may write credentials (from environment variables) to disk in cleartext.
Are there any known fixes or updates for CVE-2022-29550?
Yes, Qualys has provided security updates for the Cloud Agent on Linux to address CVE-2022-29550. It is recommended to update to the latest version available.