CVE-2023-1786
Public on 2023-04-26
Modified on 2025-09-23
Description
Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escalate their privilege.
CVSS v3 Base Score
See breakdown
Affected Packages
| Platform | Package | Release Date | Advisory | Status |
|---|---|---|---|---|
| Amazon Linux 1 | cloud-init | No Fix Planned | ||
| Amazon Linux 2 - Core | cloud-init | 2024-11-15 | ALAS2-2024-2701 | Fixed |
| Amazon Linux 2023 | cloud-init | 2023-06-07 | ALAS2023-2023-196 | Fixed |
CVSS Scores
| Score Type | Score | Vector | |
|---|---|---|---|
| Amazon Linux | CVSSv3 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| NVD | CVSSv3 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |