« Volver al listado

CVE-2022-31252

Estado: ModificadaMedia (4.4)—

A Incorrect Authorization vulnerability in chkstat of SUSE Linux Enterprise Server 12-SP5; openSUSE Leap 15.3, openSUSE Leap 15.4, openSUSE Leap Micro 5.2 did not consider group writable path components, allowing local attackers with access to a group what can write to a location included in the path to a privileged binary to influence path resolution. This issue affects: SUSE Linux Enterprise Server 12-SP5 permissions versions prior to 20170707. openSUSE Leap 15.3 permissions versions prior to 20200127. openSUSE Leap 15.4 permissions versions prior to 20201225. openSUSE Leap Micro 5.2 permissions versions prior to 20181225.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Opensuse — LeapOpensuse — Leap MicroSuse — Linux Enterprise Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-31252",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "meissner@suse.de",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.4,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.4,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "meissner@suse.de",
      "affectedData": [
        {
          "vendor": "SUSE",
          "product": "SUSE Linux Enterprise Server 12-SP5",
          "versions": [
            {
              "status": "affected",
              "version": "permissions",
              "lessThan": "20170707",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "openSUSE",
          "product": "openSUSE Leap 15.3",
          "versions": [
            {
              "status": "affected",
              "version": "permissions",
              "lessThan": "20200127",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "openSUSE",
          "product": "openSUSE Leap 15.4",
          "versions": [
            {
              "status": "affected",
              "version": "permissions",
              "lessThan": "20201225",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "openSUSE",
          "product": "openSUSE Leap Micro 5.2",
          "versions": [
            {
              "status": "affected",
              "version": "permissions",
              "lessThan": "20181225",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-10-06T18:16:01.710",
  "references": [
    {
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=1203018",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "meissner@suse.de"
    },
    {
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=1203018",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "meissner@suse.de",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Incorrect Authorization vulnerability in chkstat of SUSE Linux Enterprise Server 12-SP5; openSUSE Leap 15.3, openSUSE Leap 15.4, openSUSE Leap Micro 5.2 did not consider group writable path components, allowing local attackers with access to a group what can write to a location included in the path to a privileged binary to influence path resolution. This issue affects: SUSE Linux Enterprise Server 12-SP5 permissions versions prior to 20170707. openSUSE Leap 15.3 permissions versions prior to 20200127. openSUSE Leap 15.4 permissions versions prior to 20201225. openSUSE Leap Micro 5.2 permissions versions prior to 20181225."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de autorización incorrecta en chkstat de SUSE Linux Enterprise Server versión 12-SP5; openSUSE Leap versión 15.3, openSUSE Leap versión 15.4, openSUSE Leap Micro versión 5.2, no tenía en cuenta los componentes de la ruta de escritura del grupo, lo que permitía a atacantes locales con acceso a un grupo lo que puede escribir en una ubicación incluida en la ruta de un binario privilegiado para influir en la resolución de la ruta. Este problema afecta a: SUSE Linux Enterprise Server 12-SP5 versiones de permisos anteriores a 20170707. openSUSE Leap 15.3 versiones de permisos anteriores a 20200127. openSUSE Leap 15.4 versiones de permisos anteriores a 20201225. openSUSE Leap Micro 5.2 versiones de permisos anteriores a 20181225"
    }
  ],
  "lastModified": "2026-06-17T04:45:13.457",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:opensuse:leap:15.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "090F0D1A-6BF8-4810-8942-3FFE4FBF7FE0"
            },
            {
              "criteria": "cpe:2.3:o:opensuse:leap:15.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BE80EB04-7F9D-4C0B-85DB-4A13DEACB5E4"
            },
            {
              "criteria": "cpe:2.3:o:opensuse:leap_micro:5.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "71185E66-2527-46B5-AEEB-23EB741E9029"
            },
            {
              "criteria": "cpe:2.3:o:suse:linux_enterprise_server:12:sp5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "29AE5751-3EA5-4056-8E79-16D8DCD248EF"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "meissner@suse.de"
}