CVE-2022-31253
Severity
7.8HIGH
EPSS
0.1%
top 83.66%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedNov 9
Description
A Untrusted Search Path vulnerability in openldap2 of openSUSE Factory allows local attackers with control of the ldap user or group to change ownership of arbitrary directory entries to this user/group, leading to escalation to root. This issue affects: openSUSE Factory openldap2 versions prior to 2.6.3-404.1.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NExploitability: 1.8 | Impact: 5.2
Affected Packages2 packages
š“Vulnerability Details
2GHSAā¶
GHSA-hxf4-pc5p-7f5c: A Untrusted Search Path vulnerability in openldap2 of openSUSE Factory allows local attackers with control of the ldap user or group to change ownershā2022-11-09
CVEListā¶
openldap2: /usr/lib/openldap/start allows ldap user/group to recursively chown arbitrary directory trees to itselfā2022-11-09
šVendor Advisories
1Debianā¶
CVE-2022-31253: openldap - A Untrusted Search Path vulnerability in openldap2 of openSUSE Factory allows lo...ā2022