CVE-2022-1766

CVE-2022-1766

Vendor Anchore Inc.

Product Anchore Enterprise

Weakness CWE-522 · Insufficiently protected credentials

Published July 20, 2022

Last update September 16, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Anchore Enterprise anchorectl version 0.1.4 improperly stored credentials when generating a Software Bill of Materials. anchorectl will add the credentials used to access Anchore Enterprise API in the Software Bill of Materials (SBOM) generated by anchorectl. Users of anchorectl version 0.1.4 should upgrade to anchorectl version 0.1.5 to resolve this issue.

Key dates

02Disclosure timeline

July 20, 2022 CVE published

September 16, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-1766 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/522.html

Related vulnerabilities

Identifiers

CVE CVE-2022-1766

CWE CWE-522

Affected versions

Vendor Anchore Inc.

Product Anchore Enterprise

Affected ≥ unspecified and < 4.0.1

Vendor Anchore Inc.

Product AnchoreCTL

Affected ≥ unspecified and < 0.1.5

01Description

02Disclosure timeline

03References

04Related CVE