7.8

CVE-2022-31254: opensuse opensuse leap 15.3 Incorrect Default Permissions

CVSS: 7.8v3.1HighModified
AliasesSUSE-SU-2023:0019-1SUSE-SU-2023:0020-1SUSE-SU-2023:0021-1
Published 07-02-2023Last modified 25-03-2025
Open JSON

Vulnerability summary

CVE-2022-31254 is a high (CVSS 7.8) Incorrect Default Permissions vulnerability in opensuse opensuse leap 15.3. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 15% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
41/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.25%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 2 · Related 2
OPENSUSE-SU-2024:12886-1SUSE-SU-2023:2781-1

Timeline

  1. 07-02-2023
    PublishedVulnerability first disclosed.
  2. 25-03-2025
    Last modifiedVulnerability information updated.

Description

A Incorrect Default Permissions vulnerability in rmt-server-regsharing service of SUSE Linux Enterprise Server for SAP 15, SUSE Linux Enterprise Server for SAP 15-SP1, SUSE Manager Server 4.1; openSUSE Leap 15.3, openSUSE Leap 15.4 allows local attackers with access to the _rmt user to escalate to root. This issue affects: SUSE Linux Enterprise Server for SAP 15 rmt-server versions prior to 2.10. SUSE Linux Enterprise Server for SAP 15-SP1 rmt-server versions prior to 2.10. SUSE Manager Server 4.1 rmt-server versions prior to 2.10. openSUSE Leap 15.3 rmt-server versions prior to 2.10. openSUSE Leap 15.4 rmt-server versions prior to 2.10.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

0.25%

Chance of exploitation in the next 30 days

Percentile

15%

Versus all other CVEs

30-day change

0.00 pp

From 0.25% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.25%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (bugzilla.suse.com)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Suse36 products
  • rmt-server&distro=SUSE Enterprise Storage 6< 2.10-150100.3.42.1
  • rmt-server&distro=SUSE Enterprise Storage 7< 2.10-150200.3.29.1
  • rmt-server&distro=SUSE Enterprise Storage 7.1< 2.10-150300.3.21.1
  • rmt-server&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 2.10-150100.3.42.1
  • rmt-server&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS< 2.10-150200.3.29.1
Opensuse5 products

2 vendors · 41 products

References

10 links