Read the docs
TI-2022-22228 Aliases CVE-2022-45154GHSA-qrgp-9jwv-233w

supportconfig does not remove passwords in /etc/iscsi/iscsid.conf and /etc/target/lio_setup.sh

Priority LOW 24CWE-312Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-312.

Summary

A Cleartext Storage of Sensitive Information vulnerability in suppportutils of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 15 SP3 allows attackers that get access to the support logs to gain knowledge of the stored credentials This issue affects: SUSE Linux Enterprise Server 12 supportutils version 3.0.10-95.51.1CWE-312: Cleartext Storage of Sensitive Information and prior versions. SUSE Linux Enterprise Server 15 supportutils version 3.1.21-150000.5.44.1 and prior versions. SUSE Linux Enterprise Server 15 SP3 supportutils version 3.1.21-150300.7.35.15.1 and prior versions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00173 6th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SUSESUSE Linux Enterprise Server 12supportutils – 3.0.10-95.51.1CWE-312: Cleartext Storage of Sensitive Information—No fix listedCNA
SUSESUSE Linux Enterprise Server 15supportutils – 3.1.21-150000.5.44.1—No fix listedCNA
SUSESUSE Linux Enterprise Server 15 SP3supportutils – 3.1.21-150300.7.35.15.1—No fix listedCNA
  • SUSE Linux Enterprise Server 12 VendorSUSE Affected supportutils – 3.0.10-95.51.1CWE-312: Cleartext Storage of Sensitive Information Fixed in — No fix listed CNA
  • SUSE Linux Enterprise Server 15 VendorSUSE Affected supportutils – 3.1.21-150000.5.44.1 Fixed in — No fix listed CNA
  • SUSE Linux Enterprise Server 15 SP3 VendorSUSE Affected supportutils – 3.1.21-150300.7.35.15.1 Fixed in — No fix listed CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:opensuse:supportutils:*:*:*:*:*:*:*:*up to 3.0.10-95.51.1VulnerableopenSUSE
cpe:2.3:o:suse:linux_enterprise_server:12:-:*:*:*:*:*:*12Running onSUSE
cpe:2.3:a:opensuse:supportutils:*:*:*:*:*:*:*:*up to 3.1.21-150000.5.44.1VulnerableopenSUSE
cpe:2.3:o:suse:linux_enterprise_server:15:-:*:*:*:*:*:*15Running onSUSE
cpe:2.3:a:opensuse:supportutils:*:*:*:*:*:*:*:*up to 3.1.21-150300.7.35.15.1VulnerableopenSUSE
cpe:2.3:o:suse:linux_enterprise_server:15:sp3:*:*:*:*:*:*15 sp3Running onSUSE
  • cpe:2.3:a:opensuse:supportutils:*:*:*:*:*:*:*:* Versions up to 3.0.10-95.51.1 Vulnerable ·openSUSE
  • cpe:2.3:o:suse:linux_enterprise_server:12:-:*:*:*:*:*:* Versions 12 Running on ·SUSE
  • cpe:2.3:a:opensuse:supportutils:*:*:*:*:*:*:*:* Versions up to 3.1.21-150000.5.44.1 Vulnerable ·openSUSE
  • cpe:2.3:o:suse:linux_enterprise_server:15:-:*:*:*:*:*:* Versions 15 Running on ·SUSE
  • cpe:2.3:a:opensuse:supportutils:*:*:*:*:*:*:*:* Versions up to 3.1.21-150300.7.35.15.1 Vulnerable ·openSUSE
  • cpe:2.3:o:suse:linux_enterprise_server:15:sp3:*:*:*:*:*:* Versions 15 sp3 Running on ·SUSE

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-45154
  2. 2026-10-03 Alias added: GHSA-qrgp-9jwv-233w

References

Exploit 1

  • TI-2016-03560 Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote… KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-03506 Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary… KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-02888 Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77… KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-04302 Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3)… KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-04301 Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3)… KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-04298 Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3)… KEVCVSS 3.1CRITICAL 9.8
See all 1331 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences