title: supportconfig does not remove passwords in /etc/iscsi/iscsid.conf and /etc/target/lio_setup.sh
description: A Cleartext Storage of Sensitive Information vulnerability in suppportutils of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 15 SP3 allows attackers that get access to the support logs to gain knowledge of the stored credentials This issue affects: SUSE Linux Enterprise Server 12 supportutils version 3.0.10-95.51.1CWE-312: Cleartext Storage of Sensitive Information and prior versions. SUSE Linux Enterprise Server 15 supportutils version 3.1.21-150000.5.44.1 and prior versions. SUSE Linux Enterprise Server 15 SP3 supportutils version 3.1.21-150300.7.35.15.1 and prior versions.
problem types: CWE-312: Cleartext Storage of Sensitive Information
affected:
{
vendor: SUSE
product: SUSE Linux Enterprise Server 12
versions:
version: supportutils, status: affected, lessThanOrEqual: 3.0.10-95.51.1CWE-312: Cleartext Storage of Sensitive Information, versionType: custom
}
{
vendor: SUSE
product: SUSE Linux Enterprise Server 15
versions:
version: supportutils, status: affected, lessThanOrEqual: 3.1.21-150000.5.44.1, versionType: custom
}
{
vendor: SUSE
product: SUSE Linux Enterprise Server 15 SP3
versions:
version: supportutils, status: affected, lessThanOrEqual: 3.1.21-150300.7.35.15.1, versionType: custom
}
metrics:
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: LOW
baseScore: 4.4
baseSeverity: MEDIUM
]