What is CVE-2022-1766?

CVE-2022-1766 is a high-severity vulnerability in Anchore, classified under Insufficiently Protected Credentials. CVSS score: 7.5/10. Published 2022-07-20.

How severe is CVE-2022-1766?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in Anchore

CVE-2022-1766

Anchore Enterprise anchorectl version 0.1.4 improperly stored credentials when generating a Software Bill of Materials. anchorectl will add the credentials used to access Anchore Enterprise API in the Software Bill of Materials (SBOM) generated by anchorectl. Users of anchorectl version 0.1.4 should upgrade to anchorectl version 0.1.5 to resolve this issue.

EPSS: 0.006 (47.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Anchore
Anchore Anchorectl
Anchore Inc. Anchorectl — versions unspecified
Anchore Inc. Enterprise — versions unspecified

Weakness classification (CWE)

CWE-522 — Insufficiently Protected Credentials

References

cret@cert.org (x_refsource_CONFIRM, Release Notes, Vendor Advisory)

Frequently asked questions

What is CVE-2022-1766?: CVE-2022-1766 is a high-severity vulnerability in Anchore, classified under Insufficiently Protected Credentials. CVSS score: 7.5/10. Published 2022-07-20.
How severe is CVE-2022-1766?: High severity. CVSS v3 base score is 7.5 out of 10.