CVE-2022-4311
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
In PcVue versions 15 through 15.2.2, a vulnerability allows insertion of sensitive information into log files. A user with access to these logs can discover connection strings for data sources configured for DbConnect, which may include credentials.
Risk Assessment
The risk is that other users could gain unauthorized access to underlying data sources by extracting credentials from log files, potentially leading to data breaches or system compromise.
Recommendation
Immediately upgrade PcVue to a version later than 15.2.2 and restrict access to log files to trusted administrators only.
Original NVD description (English source)
An insertion of sensitive information into log file vulnerability exists in PcVue versions 15 through 15.2.2. This could allow a user with access to the log files to discover connection strings of data sources configured for the DbConnect, which could include credentials. Successful exploitation of this vulnerability could allow other users unauthorized access to the underlying data sources.