CVE-2022-2084 MEDIUM

CVE-2022-2084: sensitive data exposure in cloud-init logs

Vendor Canonical Ltd.

Product cloud-init

Weakness CWE-532 · Sensitive info in logs

Published April 19, 2023

Last update February 5, 2025

View on NVD All CVEs

CVSS base score

5.5/10

Attack vector Local

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords.

Key dates

02Disclosure timeline

April 19, 2023 CVE published

February 5, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-2084 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/532.html

Related vulnerabilities

04Related CVE

CVE-2025-46329 Snowflake Connector for C/C++ inserts client-side encryption key in DEBUG logs CVE-2026-40091 SpiceDB: SPICEDB_DATASTORE_CONN_URI is leaked on startup logs CVE-2025-62209 Windows License Manager Information Disclosure Vulnerability CVE-2020-11094 Potential unauthorized access to stored request & session data when plugin is misconfigured in October CMS Debugbar CVE-2022-49037