← Vulnerability feed

Vulnerability record · CVE-2022-29071 · published 5 August 2022

CVE-2022-29071: Arista cloudvision portal information exposure vulnerability

Arista · Cloudvision Portal

This advisory documents an internally found vulnerability in the on premises deployment model of Arista CloudVision Portal (CVP) where under a certain set of conditions, user passwords can be leaked in the Audit and System logs. The impact of this vulnerability is that the CVP user login passwords might be leaked to other authenticated users.

5.5 CVSS 3.1 Medium EPSS 0.20% · top 91.1% CWE-200 · Information exposureCWE-532 · Sensitive information in log file
5.5CVSS 3.1 base score
0.20%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

This advisory documents an internally found vulnerability in the on premises deployment model of Arista CloudVision Portal (CVP) where under a certain set of conditions, user passwords can be leaked in the Audit and System logs. The impact of this vulnerability is that the CVP user login passwords might be leaked to other authenticated users.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.arista.com/en/support/advisories-notices/security-advisory/15865-security-advisory-0079 Vendor Advisory
https://www.arista.com/en/support/advisories-notices/security-advisory/15865-security-advisory-0079 Vendor Advisory

Track CVE-2022-29071 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2026-31431Linux kernel algif_aead in-place crypto operation flawThe Linux kernel's algif_aead AF_ALG AEAD interface operated in-place on buffers that come from different mappings, a flaw the fix resolves by revert…KEVEPSS 3.4%analysed8.8CVE-2016-9012Arista cloudvision portal permissions and access controls vulnerabilityCloudVision Portal (CVP) before 2016.1.2.1 allows remote authenticated users to gain access to the internal configuration mechanisms via the manageme…EPSS 1.5%8.1CVE-2023-24546Arista cloudvision portal improper access control vulnerabilityOn affected versions of the CloudVision Portal improper access controls on the connection from devices to CloudVision could enable a malicious actor …EPSS 0.47%7.8CVE-2019-18181Arista cloudvision portal vulnerabilityIn CloudVision Portal all releases in the 2018.1 and 2018.2 Code train allows users with read-only permissions to bypass permissions for restricted f…EPSS 0.34%7.5CVE-2020-13881Pam tacplus project pam tacplus sensitive information in log file vulnerabilityIn support.c in pam_tacplus 1.3.8 through 1.5.1, the TACACS+ shared secret gets logged via syslog if the DEBUG loglevel and journald are used.EPSS 1.7%7.5CVE-2019-17596Golang go interpretation conflict vulnerabilityGo before 1.12.11 and 1.3.x before 1.13.2 can panic upon an attempt to process network traffic containing an invalid DSA public key. There are severa…EPSS 4.7%6.5CVE-2020-24333Arista cloudvision portal vulnerabilityA vulnerability in Arista’s CloudVision Portal (CVP) prior to 2020.2 allows users with “read-only” or greater access rights to the Configlet Manageme…EPSS 0.84%6.5CVE-2018-12357Arista cloudvision portal incorrect permission assignment vulnerabilityArista CloudVision Portal through 2018.1.1 has Incorrect Permissions.EPSS 0.77%

Source: NIST National Vulnerability Database (record CVE-2022-29071), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.