4.4

CVE-2022-31252: opensuse leap Incorrect Authorization

CVSS: 4.4v3.1MediumModified
AliasesSUSE-SU-2022:3353-1SUSE-SU-2022:3382-1SUSE-SU-2022:3394-1
Published 06-10-2022Last modified 16-09-2024
Open JSON

Vulnerability summary

CVE-2022-31252 is a medium (CVSS 4.4) Incorrect Authorization vulnerability in opensuse leap. EPSS estimates a 0.15% chance of exploitation in the next 30 days, higher than 3.7% of scored vulnerabilities.

Overall risk
18/100
0100
Low · default modelHow is this calculated?
CVSS score
4.4/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.15%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 06-10-2022
    PublishedVulnerability first disclosed.
  2. 16-09-2024
    Last modifiedVulnerability information updated.

Description

A Incorrect Authorization vulnerability in chkstat of SUSE Linux Enterprise Server 12-SP5; openSUSE Leap 15.3, openSUSE Leap 15.4, openSUSE Leap Micro 5.2 did not consider group writable path components, allowing local attackers with access to a group what can write to a location included in the path to a privileged binary to influence path resolution. This issue affects: SUSE Linux Enterprise Server 12-SP5 permissions versions prior to 20170707. openSUSE Leap 15.3 permissions versions prior to 20200127. openSUSE Leap 15.4 permissions versions prior to 20201225. openSUSE Leap Micro 5.2 permissions versions prior to 20181225.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

0.15%

Chance of exploitation in the next 30 days

Percentile

4%

Versus all other CVEs

30-day change

0.00 pp

From 0.14% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.15%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Opensuse9 products
Suse8 products
  • permissions&distro=SUSE Linux Enterprise Micro 5.1< 20181225-150200.23.15.1
  • permissions&distro=SUSE Linux Enterprise Micro 5.2< 20181225-150200.23.15.1
  • permissions&distro=SUSE Linux Enterprise Module for Basesystem 15 SP3< 20181225-150200.23.15.1
  • permissions&distro=SUSE Linux Enterprise Module for Basesystem 15 SP4< 20201225-150400.5.11.1
  • permissions&distro=SUSE Linux Enterprise Server 12 SP5< 20170707-6.10.1

2 vendors · 17 products

References

9 links