CVE-2022-29550
First published: Thu Aug 18 2022(Updated: )
** DISPUTED ** An issue was discovered in Qualys Cloud Agent 4.8.0-49. It writes "ps auxwwe" output to the /var/log/qualys/qualys-cloud-agent-scan.log file. This may, for example, unexpectedly write credentials (from environment variables) to disk in cleartext. NOTE: there are no common circumstances in which qualys-cloud-agent-scan.log can be read by a user other than root; however, the file contents could be exposed through site-specific operational practices. The vendor does NOT characterize this as a vulnerability because the ps data collection is intentional, and would only capture credentials on a machine that was already affected by the CWE-214 weakness.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Qualys Cloud Agent | =4.8.0-49 | |
| =4.8.0-49 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this issue in Qualys Cloud Agent?
The vulnerability ID for this issue in Qualys Cloud Agent is CVE-2022-29550.
What is the severity level of CVE-2022-29550?
CVE-2022-29550 has a severity level of medium with a CVSS score of 5.5.
What is the affected software version of CVE-2022-29550?
The affected software version of CVE-2022-29550 is Qualys Cloud Agent 4.8.0-49.
What is the impact of CVE-2022-29550?
CVE-2022-29550 may write credentials (from environment variables) to disk in cleartext.
Are there any known fixes or updates for CVE-2022-29550?
Yes, Qualys has provided security updates for the Cloud Agent on Linux to address CVE-2022-29550. It is recommended to update to the latest version available.
- collector/nvd-index
- agent/references
- agent/type
- agent/severity
- agent/weakness
- agent/author
- agent/softwarecombine
- agent/status
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/tags
- agent/event
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/source
- status/disputed
- vendor/qualys
- canonical/qualys cloud agent
- version/qualys cloud agent/4.8.0-49