CVE-2022-37706: enlightenment Improper Privilege Management

CVSS: 7.8v3.1HighModified

AliasesMGASA-2022-0360openSUSE-SU-2022:10153-1UBUNTU-CVE-2022-37706+3 more

Published 25-12-2022Last modified 14-04-2025

Vulnerability summary

CVE-2022-37706 is a high (CVSS 7.8) Improper Privilege Management vulnerability in enlightenment. EPSS estimates a 5.69% chance of exploitation in the next 30 days, higher than 92.9% of scored vulnerabilities. 3 public exploits are recorded.

Overall risk

42/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.8/10

010

High · v3.1 (CVE.org)

EPSS score

5.69%

0%100%

Low · +0.16 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits3github, exploit-database, metasploit

Timeline

25-12-2022
PublishedVulnerability first disclosed.
14-04-2025
Last modifiedVulnerability information updated.

Description

enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and the system library function mishandles pathnames that begin with a /dev/.. substring.

CVSS metrics

4 scores · 4 sources · 1 version

v3.17.8

EPSS trend

Probability

5.69%

Chance of exploitation in the next 30 days

Percentile

93%

Versus all other CVEs

30-day change

+0.16 pp

From 5.53% on 19-09-2026

19-09-202619-10-2026

EPSS score

5.69%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

3 found

githubUnverified
Cve 2022 37706 Lpe Exploit
Maturity: poc
exploit-databaselocallinuxUnverified
Enlightenment v0.25.3 - Privilege escalation
Maturity: poc
MetasploitremoteVerified
Ubuntu Enlightenment Mount Priv Esc
exploit/linux/local/ubuntu_enlightenment_mount_priv_esc
Maturity: weaponized