CVE-2022-21952: A Missing Authentication for Critical Function vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to…

PriorityP345high7.5CVSS 3.1

AVNACLPRNUINSUCNINAH

EPSS

1.46%

70.5th percentile

A Missing Authentication for Critical Function vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to easily exhaust available disk resources leading to DoS. This issue affects: SUSE Manager Server 4.1 spacewalk-java versions prior to 4.1.46. SUSE Manager Server 4.2 spacewalk-java versions prior to 4.2.37.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
suse	manager_server	>= 4.1 < 4.1.46	4.1.46
suse	manager_server	>= 4.2 < 4.2.37	4.2.37
suse	suse_manager_server_4.1	>= spacewalk-java < 4.1.46	4.1.46
suse	suse_manager_server_4.2	>= spacewalk-java < 4.2.37	4.2.37

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.