CVE-2022-31253

published 2022-11-09

CVE-2022-31253: A Untrusted Search Path vulnerability in openldap2 of openSUSE Factory allows local attackers with control of the ldap user or group to change ownership of…

high 7.8 CVSS 3.1

AV L AC L PR L UI N S U C H I H A H

A Untrusted Search Path vulnerability in openldap2 of openSUSE Factory allows local attackers with control of the ldap user or group to change ownership of arbitrary directory entries to this user/group, leading to escalation to root. This issue affects: openSUSE Factory openldap2 versions prior to 2.6.3-404.1.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
debian	openldap	—	—
opensuse	factory	>= openldap2 < 2.6.3-404.1	2.6.3-404.1
opensuse	openldap2	< 2.6.3-404.1	2.6.3-404.1

CWE-426