CVE-2022-31252
Published: Oct 6, 2022
Modified: Sep 16, 2024
CVSS v3.1
4.4
Description
A Incorrect Authorization vulnerability in chkstat of SUSE Linux Enterprise Server 12-SP5; openSUSE Leap 15.3, openSUSE Leap 15.4, openSUSE Leap Micro 5.2 did not consider group writable path components, allowing local attackers with access to a group what can write to a location included in the path to a privileged binary to influence path resolution. This issue affects: SUSE Linux Enterprise Server 12-SP5 permissions versions prior to 20170707. openSUSE Leap 15.3 permissions versions prior to 20200127. openSUSE Leap 15.4 permissions versions prior to 20201225. openSUSE Leap Micro 5.2 permissions versions prior to 20181225.
| Vendor | Product | Versions |
|---|---|---|
SUSE | SUSE Linux Enterprise Server 12-SP5 | affected permissions - < 20170707 |
openSUSE | openSUSE Leap 15.3 | affected permissions - < 20200127 |
openSUSE | openSUSE Leap 15.4 | affected permissions - < 20201225 |
openSUSE | openSUSE Leap Micro 5.2 | affected permissions - < 20181225 |
Weaknesses (CWE)
CVSS v3.1 Details
CVSS v3.1 Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now