CVE-2022-31248: suse manager_server Observable Response Discrepancy

CVSS: 5.3v3.1MediumModified

AliasesSUSE-SU-2022:2567-1SUSE-SU-2022:2568-1SUSE-SU-2022:3194-1

Published 22-06-2022Last modified 16-09-2024

Vulnerability summary

CVE-2022-31248 is a medium (CVSS 5.3) Observable Response Discrepancy vulnerability in suse manager_server. EPSS estimates a 1.02% chance of exploitation in the next 30 days, higher than 62.7% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

31/100

0100

Medium · default modelHow is this calculated?

CVSS score

5.3/10

010

Medium · v3.1 (CVE.org)

EPSS score

1.02%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 4 · Related 4

SUSE-SU-2022:2143-1 SUSE-SU-2022:2144-1 SUSE-SU-2022:2145-1 SUSE-SU-2022:2146-1

Timeline

22-06-2022
PublishedVulnerability first disclosed.
16-09-2024
Last modifiedVulnerability information updated.

Description

A Observable Response Discrepancy vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to discover valid usernames. This issue affects: SUSE Manager Server 4.1 spacewalk-java versions prior to 4.1.46-1. SUSE Manager Server 4.2 spacewalk-java versions prior to 4.2.37-1.

CVSS metrics

3 scores · 2 sources · 2 versions

v3.15.3v2.05.0

EPSS trend

Probability

1.02%

Chance of exploitation in the next 30 days

Percentile

63%

Versus all other CVEs

30-day change

0.00 pp

From 1.02% on 18-09-2026

18-09-202618-10-2026

EPSS score

1.02%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

referenceUnverified
Exploit Reference (bugzilla.suse.com)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-204Observable Response DiscrepancyThe product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

Affected systems

Suse74 products

apache-commons-csv&distro=SUSE Manager Server Module 4.2< 1.2-150300.3.3.2
apache-commons-csv&distro=SUSE Manager Server Module 4.3< 1.2-150400.3.3.1
apache-commons-math3&distro=SUSE Manager Server Module 4.2< 3.2-150300.3.3.2
apache-commons-math3&distro=SUSE Manager Server Module 4.3< 3.2-150400.3.3.1
drools&distro=SUSE Manager Server Module 4.2< 7.17.0-150300.4.3.2

drools&distro=SUSE Manager Server Module 4.3< 7.17.0-150400.3.3.1
image-sync-formula&distro=SUSE Manager Server Module 4.3< 0.1.1658330139.861779d-150400.3.3.1
inter-server-sync&distro=SUSE Manager Server Module 4.3< 0.2.3-150400.3.3.1
jakarta-commons-validator&distro=SUSE Manager Server Module 4.2< 1.1.4-21.150300.21.3.3
jakarta-commons-validator&distro=SUSE Manager Server Module 4.3< 1.1.4-21.150400.21.3.4
jose4j&distro=SUSE Manager Server Module 4.2< 0.5.1-150300.3.3.2
jose4j&distro=SUSE Manager Server Module 4.3< 0.5.1-150400.3.3.1
kie-api&distro=SUSE Manager Server Module 4.2< 7.17.0-150300.4.3.2
kie-api&distro=SUSE Manager Server Module 4.3< 7.17.0-150400.3.3.1
mvel2&distro=SUSE Manager Server Module 4.2< 2.2.6.Final-150300.3.3.2
mvel2&distro=SUSE Manager Server Module 4.3< 2.2.6.Final-150400.3.3.1
optaplanner&distro=SUSE Manager Server Module 4.2< 7.17.0-150300.4.3.2
optaplanner&distro=SUSE Manager Server Module 4.3< 7.17.0-150400.3.3.1
py27-compat-salt&distro=SUSE Manager Server Module 4.2< 3000.3-150300.7.7.20.2
python-susemanager-retail&distro=SUSE Manager Server Module 4.2< 1.0.1653987003.92d4870-150300.3.3.2
python-susemanager-retail&distro=SUSE Manager Server Module 4.3< 1.0.1658330139.861779d-150400.3.3.1
python-urlgrabber&distro=SUSE Manager Server Module 4.3< 4.1.0-150400.3.3.1
release-notes-susemanager-proxy&distro=SUSE Manager Proxy 4.2< 4.2.8-150300.3.40.2
release-notes-susemanager-proxy&distro=SUSE Manager Retail Branch Server 4.2< 4.2.8-150300.3.40.2
release-notes-susemanager&distro=SUSE Manager Server 4.2< 4.2.8-150300.3.51.2
reprepro&distro=SUSE Manager Server Module 4.3< 5.3.0-150400.3.3.1
salt-netapi-client&distro=SUSE Manager Server Module 4.3< 0.20.0-150400.3.3.5
smdba&distro=SUSE Manager Server Module 4.2< 1.7.10-0.150300.3.9.2
smdba&distro=SUSE Manager Server Module 4.3< 1.7.10-0.150400.4.3.1
spacecmd&distro=SUSE Manager Server Module 4.2< 4.2.18-150300.4.24.3
spacecmd&distro=SUSE Manager Server Module 4.3< 4.3.14-150400.3.3.2
spacewalk-admin&distro=SUSE Manager Server Module 4.2< 4.2.11-150300.3.12.3
spacewalk-backend&distro=SUSE Manager Server Module 4.2< 4.2.23-150300.4.26.3
spacewalk-backend&distro=SUSE Manager Server Module 4.3< 4.3.15-150400.3.3.5
spacewalk-branding&distro=SUSE Manager Server Module 4.2< 4.2.14-150300.3.12.3
spacewalk-certs-tools&distro=SUSE Manager Server Module 4.2< 4.2.17-150300.3.21.2
spacewalk-certs-tools&distro=SUSE Manager Server Module 4.3< 4.3.14-150400.3.3.2
spacewalk-client-tools&distro=SUSE Manager Server Module 4.2< 4.2.19-150300.4.21.3
spacewalk-client-tools&distro=SUSE Manager Server Module 4.3< 4.3.11-150400.3.3.4
spacewalk-config&distro=SUSE Manager Server Module 4.3< 4.3.9-150400.3.3.3
spacewalk-java&distro=SUSE Manager Server Module 4.2< 4.2.40-150300.3.40.2
spacewalk-java&distro=SUSE Manager Server Module 4.3< 4.3.35-150400.3.3.5
spacewalk-search&distro=SUSE Manager Server Module 4.2< 4.2.7-150300.3.9.2
spacewalk-search&distro=SUSE Manager Server Module 4.3< 4.3.6-150400.3.3.3
spacewalk-setup&distro=SUSE Manager Server Module 4.2< 4.2.11-150300.3.15.2
spacewalk-setup&distro=SUSE Manager Server Module 4.3< 4.3.10-150400.3.3.3
spacewalk-utils&distro=SUSE Manager Server Module 4.2< 4.2.17-150300.3.18.3
spacewalk-utils&distro=SUSE Manager Server Module 4.3< 4.3.13-150400.3.3.3
spacewalk-web&distro=SUSE Manager Server Module 4.2< 4.2.28-150300.3.24.3
spacewalk-web&distro=SUSE Manager Server Module 4.3< 4.3.23-150400.3.3.4
spacewalk&distro=SUSE Manager Server Module 4.3< 4.3.5-150400.3.3.2
subscription-matcher&distro=SUSE Manager Server Module 4.2< 0.29-150300.6.9.2
subscription-matcher&distro=SUSE Manager Server Module 4.3< 0.29-150400.3.3.1
susemanager-build-keys&distro=SUSE Manager Server Module 4.3< 15.4.3-150400.3.3.1
susemanager-doc-indexes&distro=SUSE Manager Server Module 4.2< 4.2-150300.12.30.3
susemanager-docs_en&distro=SUSE Manager Server Module 4.2< 4.2-150300.12.30.2
susemanager-docs_en&distro=SUSE Manager Server Module 4.3< 4.3-150400.9.3.1
susemanager-schema&distro=SUSE Manager Server Module 4.2< 4.2.23-150300.3.24.3
susemanager-schema&distro=SUSE Manager Server Module 4.3< 4.3.13-150400.3.3.3
susemanager-sls&distro=SUSE Manager Server Module 4.2< 4.2.26-150300.3.30.1
susemanager-sls&distro=SUSE Manager Server Module 4.3< 4.3.24-150400.3.3.1
susemanager-sync-data&distro=SUSE Manager Server Module 4.2< 4.2.13-150300.3.21.2
susemanager&distro=SUSE Manager Server Module 4.2< 4.2.35-150300.3.36.1
susemanager&distro=SUSE Manager Server Module 4.3< 4.3.18-150400.3.3.2
uyuni-common-libs&distro=SUSE Manager Server Module 4.3< 4.3.5-150400.3.3.2
virtual-host-gatherer&distro=SUSE Manager Server Module 4.2< 1.0.23-150300.3.6.2
virtual-host-gatherer&distro=SUSE Manager Server Module 4.3< 1.0.23-150400.3.3.1
woodstox&distro=SUSE Manager Server Module 4.2< 4.4.2-150300.3.3.2
woodstox&distro=SUSE Manager Server Module 4.3< 4.4.2-150400.3.3.1
xmlpull-api&distro=SUSE Manager Server Module 4.2< 1.1.3.1-150300.3.3.2
xmlpull-api&distro=SUSE Manager Server Module 4.3< 1.1.3.1-150400.3.3.1
manager_server≥ 4.1, < 4.1.46-1 | ≥ 4.2, < 4.2.37-1
suse manager server 4.1≥ spacewalk-java, < 4.1.46-1
suse manager server 4.2≥ spacewalk-java, < 4.2.37-1

Show all 74

1 vendor · 74 products

References

76 links

bugzilla.suse.com/show_bug.cgi?id=1199629X Refsource CONFIRMExploitIssue TrackingThird Party Advisory
www.suse.com/support/update/announcement/2022/suse-su-20222567-1/Advisory
bugzilla.suse.com/1179962REPORT
bugzilla.suse.com/1182742REPORT
bugzilla.suse.com/1189501REPORT
bugzilla.suse.com/1192850REPORT
bugzilla.suse.com/1193032REPORT
bugzilla.suse.com/1193238REPORT
bugzilla.suse.com/1194262REPORT
bugzilla.suse.com/1194394REPORT

Show all 76 references

bugzilla.suse.com/1196977REPORT
bugzilla.suse.com/1197429REPORT
bugzilla.suse.com/1197507REPORT
bugzilla.suse.com/1198191REPORT
bugzilla.suse.com/1198356REPORT
bugzilla.suse.com/1198358REPORT
bugzilla.suse.com/1198429REPORT
bugzilla.suse.com/1198646REPORT
bugzilla.suse.com/1198686REPORT
bugzilla.suse.com/1198914REPORT
bugzilla.suse.com/1198944REPORT
bugzilla.suse.com/1198999REPORT
bugzilla.suse.com/1199019REPORT
bugzilla.suse.com/1199036REPORT
bugzilla.suse.com/1199049REPORT
bugzilla.suse.com/1199401REPORT
bugzilla.suse.com/1199438REPORT
bugzilla.suse.com/1199466REPORT
bugzilla.suse.com/1199523REPORT
bugzilla.suse.com/1199528REPORT
bugzilla.suse.com/1199577REPORT
bugzilla.suse.com/1199596REPORT
bugzilla.suse.com/1199629REPORT
bugzilla.suse.com/1199646REPORT
bugzilla.suse.com/1199656REPORT
bugzilla.suse.com/1199677REPORT
bugzilla.suse.com/1199679REPORT
bugzilla.suse.com/1199727REPORT
bugzilla.suse.com/1199874REPORT
bugzilla.suse.com/1199888REPORT
bugzilla.suse.com/1200087REPORT
bugzilla.suse.com/1200703REPORT
bugzilla.suse.com/1200707REPORT
bugzilla.suse.com/1200863REPORT
bugzilla.suse.com/1201782REPORT
bugzilla.suse.com/1201842REPORT
www.suse.com/security/cve/CVE-2022-31248WEB
www.suse.com/support/update/announcement/2022/suse-su-20222568-1/Advisory
www.suse.com/support/update/announcement/2022/suse-su-20223194-1/Advisory
bugzilla.suse.com/1172179REPORT
bugzilla.suse.com/1186011REPORT
bugzilla.suse.com/1187028REPORT
bugzilla.suse.com/1191925REPORT
bugzilla.suse.com/1195455REPORT
bugzilla.suse.com/1199147REPORT
bugzilla.suse.com/1199157REPORT
bugzilla.suse.com/1199659REPORT
bugzilla.suse.com/1199662REPORT
bugzilla.suse.com/1199663REPORT
bugzilla.suse.com/1199714REPORT
bugzilla.suse.com/1199779REPORT
bugzilla.suse.com/1199817REPORT
bugzilla.suse.com/1199950REPORT
bugzilla.suse.com/1199984REPORT
bugzilla.suse.com/1199998REPORT
bugzilla.suse.com/1200276REPORT
bugzilla.suse.com/1200347REPORT
bugzilla.suse.com/1200532REPORT
bugzilla.suse.com/1200591REPORT
bugzilla.suse.com/1200606REPORT
bugzilla.suse.com/1201003REPORT
bugzilla.suse.com/1201142REPORT
bugzilla.suse.com/1201189REPORT
bugzilla.suse.com/1201224REPORT
bugzilla.suse.com/1201411REPORT
bugzilla.suse.com/1201498REPORT

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities