CVE-2022-1766
Last modified
CVE-2022-1766 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Anchore Enterprise anchorectl version 0.1.4 improperly stored credentials when generating a Software Bill of Materials. anchorectl will add the credentials used to access Anchore Enterprise API in the Software Bill of Materials (SBOM) generated by anchorectl. EPSS estimates a 0.59% chance of exploitation in the next 30 days.
Description
Anchore Enterprise anchorectl version 0.1.4 improperly stored credentials when generating a Software Bill of Materials. anchorectl will add the credentials used to access Anchore Enterprise API in the Software Bill of Materials (SBOM) generated by anchorectl. Users of anchorectl version 0.1.4 should upgrade to anchorectl version 0.1.5 to resolve this issue.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Anchore | Anchore | < 4.0.1 |
| Anchore | Anchorectl | < 0.1.5 |
References
- https://docs.anchore.com/current/docs/releasenotes/401/Release Notes, Vendor Advisory
- https://docs.anchore.com/current/docs/releasenotes/401/Release Notes, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-1766?
How severe is CVE-2022-1766?
How do I fix CVE-2022-1766?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-1760The Core Control WordPress plugin through 1.2.1 does not hav…4.3
- CVE-2022-1761The Peter’s Collaboration E-mails WordPress plugin through 2…6.5
- CVE-2022-1762The iQ Block Country WordPress plugin before 1.2.20 does not…7.5
- CVE-2022-1763Due to missing checks the Static Page eXtended WordPress plu…5.4
- CVE-2022-1764The WP-chgFontSize WordPress plugin through 1.8 does not hav…5.4
- CVE-2022-1765The Hot Linked Image Cacher WordPress plugin through 1.16 is…8.8
- CVE-2022-1767Server-Side Request Forgery (SSRF) in GitHub repository jgra…7.5
- CVE-2022-1768The RSVPMaker plugin for WordPress is vulnerable to unauthen…7.5
- CVE-2022-1769Buffer Over-read in GitHub repository vim/vim prior to 8.2.4…7.8
- CVE-2022-1770Improper Privilege Management in GitHub repository polonel/t…8.8
- CVE-2022-1771Uncontrolled Recursion in GitHub repository vim/vim prior to…5.5
- CVE-2022-1772The Google Places Reviews WordPress plugin before 2.0.0 does…4.8
Are you affected by CVE-2022-1766?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST