Read the docs
TI-2022-01632 Aliases CVE-2022-1766

Insufficiently protected credentials in Anchore Enterprise

Priority LOW 34CWE-522Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-522.

Summary

Anchore Enterprise anchorectl version 0.1.4 improperly stored credentials when generating a Software Bill of Materials. anchorectl will add the credentials used to access Anchore Enterprise API in the Software Bill of Materials (SBOM) generated by anchorectl. Users of anchorectl version 0.1.4 should upgrade to anchorectl version 0.1.5 to resolve this issue.

Why it matters now

EPSS 0.00701 53rd percentileScored 2026-11-07
Fix Fixed Anchore Enterprise (Anchore Inc.): 4.0.1AnchoreCTL (Anchore Inc.): 0.1.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
anchoreAnchore Enterprisebefore 4.0.14.0.1Patch availableCNA
anchoreAnchoreCTLbefore 0.1.50.1.5Patch availableCNA
  • Anchore Enterprise Vendoranchore Affected before 4.0.1 Fixed in 4.0.1 Patch available CNA
  • AnchoreCTL Vendoranchore Affected before 0.1.5 Fixed in 0.1.5 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:anchore:anchore:*:*:*:*:enterprise:*:*:*before 4.0.1Vulnerableanchore
cpe:2.3:a:anchore:anchorectl:*:*:*:*:*:*:*:*before 0.1.5Vulnerableanchore
  • cpe:2.3:a:anchore:anchore:*:*:*:*:enterprise:*:*:* Versions before 4.0.1 Vulnerable ·anchore
  • cpe:2.3:a:anchore:anchorectl:*:*:*:*:*:*:*:* Versions before 0.1.5 Vulnerable ·anchore

Remediation

  • Fix · CNA Anchore Enterprise (Anchore Inc.) Fixed in 4.0.1
  • Fix · CNA AnchoreCTL (Anchore Inc.) Fixed in 0.1.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-1766

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences