CVE-2022-31252: permissions: chkstat does not check for group-writable parent directories or target files in safeOpen()
SUSE · SUSE Linux Enterprise Server 12-SP5
Vendor fix available · Affected: SUSE Linux Enterprise Server 12-SP5 · Exploitation: unlikely (under 1%)
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 4% of scored CVEs
DescriptionCVE.org
A Incorrect Authorization vulnerability in chkstat of SUSE Linux Enterprise Server 12-SP5; openSUSE Leap 15.3, openSUSE Leap 15.4, openSUSE Leap Micro 5.2 did not consider group writable path components, allowing local attackers with access to a group what can write to a location included in the path to a privileged binary to influence path resolution. This issue affects: SUSE Linux Enterprise Server 12-SP5 permissions versions prior to 20170707. openSUSE Leap 15.3 permissions versions prior to 20200127. openSUSE Leap 15.4 permissions versions prior to 20201225. openSUSE Leap Micro 5.2 permissions versions prior to 20181225.
Affected products4
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- SUSE · SUSE Linux Enterprise Server 12-SP5from permissions before 20170707
- openSUSE · openSUSE Leap 15.3from permissions before 20200127
- openSUSE · openSUSE Leap 15.4from permissions before 20201225
- openSUSE · openSUSE Leap Micro 5.2from permissions before 20181225
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Unlikely (under 1%). EPSS under 1%, or no score yet.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Vendor
- SUSE
- Published
- October 2022
CoverageNo articles yet
No CyberSIXT article names CVE-2022-31252 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.