CVE-2022-45154

supportconfig does not remove passwords in /etc/iscsi/iscsid.conf and /etc/target/lio_setup.sh

MEDIUM

5.5

CVSS Score

Published: February 15, 2023 at 12:00 AM UTC

Updated: June 17, 2026 at 05:09 AM UTC

2 products affected across 2 vendorsSupportutilsLinux Enterprise Server

Using SUSE Linux Enterprise Server 12 by SUSE?

Get instant alerts when new vulnerabilities affect SUSE Linux Enterprise Server 12 - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.2%

SSVC

No known exploit

Description

A Cleartext Storage of Sensitive Information vulnerability in suppportutils of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 15 SP3 allows attackers that get access to the support logs to gain knowledge of the stored credentials This issue affects: SUSE Linux Enterprise Server 12 supportutils version 3.0.10-95.51.1CWE-312: Cleartext Storage of Sensitive Information and prior versions. SUSE Linux Enterprise Server 15 supportutils version 3.1.21-150000.5.44.1 and prior versions. SUSE Linux Enterprise Server 15 SP3 supportutils version 3.1.21-150300.7.35.15.1 and prior versions.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Supportutils · openSUSE

95%

v ≤ 3.0.10-95.51.1v ≤ 3.1.21-150000.5.44.1v ≤ 3.1.21-150300.7.35.15.1

suse-linux-enterprise-server (environment)

Linux Enterprise Server · SUSE

60%

supportutils ≤ v ≤ 3.0.10-95.51.1CWE-312: Cleartext Storage of Sensitive Informationsupportutils ≤ v ≤ 3.1.21-150000.5.44.1supportutils ≤ v ≤ 3.1.21-150300.7.35.15.1supportutils