CVE-2021-44862 HIGH

CVE-2021-44862: Sensitive Information store in NSClient logs

Vendor Netskope
Product NSClient
Weakness CWE-532 · Sensitive info in logs
Published November 3, 2022
Last update May 2, 2025

CVSS base score

8.4/10
Attack vector Local
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Netskope client is impacted by a vulnerability where an authenticated, local attacker can view sensitive information stored in NSClient logs which should be restricted. The vulnerability exists because the sensitive information is not masked/scrubbed before writing in the logs. A malicious user can use the sensitive information to download data and impersonate another user.

Key dates

02Disclosure timeline

November 3, 2022 CVE published
May 2, 2025 Record updated