{
  "document": {
    "category": "security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "publisher": {
      "category": "vendor",
      "contact_details": "support@arista.com",
      "name": "Arista PSIRT",
      "namespace": "https://www.arista.com"
    },
    "title": "Security Advisory 79",
    "tracking": {
      "current_release_date": "2022-07-19T21:47:12Z",
      "generator": {
        "engine": {
          "name": "Arista Networks SecEng Service CSAF Generator"
        }
      },
      "id": "Arista Networks Security Advisory 79",
      "initial_release_date": "2022-07-19T21:47:12Z",
      "revision_history": [
        {
          "date": "2022-07-19T21:47:12Z",
          "number": "1",
          "summary": "Document created"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version",
                    "name": "CloudVision Portal version 2020.2.0",
                    "product": {
                      "name": "CloudVision Portal version 2020.2.0",
                      "product_id": "CSAFPID-0"
                    }
                  }
                ],
                "category": "product_name",
                "name": "CloudVision Portal"
              }
            ],
            "category": "product_family",
            "name": "Software Products"
          }
        ],
        "category": "vendor",
        "name": "Arista Networks, Inc."
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-29071",
      "id": {
        "system_name": "Arista Bug ID",
        "text": "695468"
      },
      "notes": [
        {
          "category": "description",
          "text": "This advisory documents a vulnerability in Arista Cloud Vision Portal (CVP) where under a certain set of conditions user passwords can be written to the Audit and System logs.\n\nThe impact of this vulnerability is that users of Cloud Vision Portal are able to see passwords of other logged in users.\n\nWhile this advisory is similar to Arista Security Advisory 45 it is different both in the underlying root cause and also that it discloses the passwords in the Audit logs.\n",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "first_affected": [
          "CSAFPID-0"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "Public notification",
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29071"
        }
      ],
      "remediations": [
        {
          "category": "none_available",
          "details": "Not fixed in CloudVision Portal version 2020.2.0",
          "product_ids": [
            "CSAFPID-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0"
          ]
        }
      ],
      "title": "CVE-2022-29071"
    }
  ]
}