CVE-2022-45157
Last modified
CVE-2022-45157 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. A vulnerability has been identified in the way that Rancher stores vSphere's CPI (Cloud Provider Interface) and CSI (Container Storage Interface) credentials used to deploy clusters through the vSphere cloud provider. This issue leads to the vSphere CPI and CSI passwords being stored in a plaintext object inside Rancher. EPSS estimates a 0.44% chance of exploitation in the next 30 days.
Description
A vulnerability has been identified in the way that Rancher stores vSphere's CPI (Cloud Provider Interface) and CSI (Container Storage Interface) credentials used to deploy clusters through the vSphere cloud provider. This issue leads to the vSphere CPI and CSI passwords being stored in a plaintext object inside Rancher. This vulnerability is only applicable to users that deploy clusters in vSphere environments.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2022-45157?
How severe is CVE-2022-45157?
How do I fix CVE-2022-45157?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-45150A reflected cross-site scripting vulnerability was discovere…6.1
- CVE-2022-45151The stored-XSS vulnerability was discovered in Moodle which …5.4
- CVE-2022-45152A blind Server-Side Request Forgery (SSRF) vulnerability was…9.1
- CVE-2022-45153An Incorrect Default Permissions vulnerability in saphanaboo…7.8
- CVE-2022-45154A Cleartext Storage of Sensitive Information vulnerability i…5.5
- CVE-2022-45155An Improper Handling of Exceptional Conditions vulnerability…5.5
- CVE-2022-4516Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2022-45163An information-disclosure vulnerability exists on select NXP…4.6
- CVE-2022-45164An issue was discovered in Archibus Web Central 2022.03.01.1…4.3
- CVE-2022-45165An issue was discovered in Archibus Web Central 2022.03.01.1…8.8
- CVE-2022-45166An issue was discovered in Archibus Web Central 2022.03.01.1…4.3
- CVE-2022-45167An issue was discovered in Archibus Web Central 2022.03.01.1…4.3
Are you affected by CVE-2022-45157?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST