Log File INFO Leak in QVR Pro Client 2.3.0.0419 (Admin Auth)
CVE-2022-27599 Published on September 8, 2023

QVR Pro Client
An insertion of sensitive information into Log file vulnerability has been reported to affect product. If exploited, the vulnerability possibly provides local authenticated administrators with an additional, less-protected path to acquiring the information via unspecified vectors. We have already fixed the vulnerability in the following version: Windows 10 SP1, Windows 11, Mac OS, and Mac M1: QVR Pro Client 2.3.0.0420 and later

NVD

Vulnerability Analysis

CVE-2022-27599 can be exploited with local system access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:
LOCAL
Attack Complexity:
LOW
Privileges Required:
HIGH
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Type

Insertion of Sensitive Information into Log File

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.


Products Associated with CVE-2022-27599

Want to know whenever a new CVE is published for QNAP Qvr Pro Client? stack.watch will email you.

QNAP Qvr Pro Client
 

Affected Versions

QNAP Systems Inc. QVR Pro Client:

Exploit Probability

EPSS
0.02%
Percentile
5.53%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.