Log in Start free

Vulnerability · Published Jun 22, 2022 · Assigned by suse

CVE-2022-21952SUMA unauthenticated remote DoS via resource exhaustion

High 7.5

In plain English

A high-severity missing authentication in SUSE Manager Server 4.1 from SUSE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.5%top 24.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A Missing Authentication for Critical Function vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to easily exhaust available disk resources leading to DoS. This issue affects: SUSE Manager Server 4.1 spacewalk-java versions prior to 4.1.46. SUSE Manager Server 4.2 spacewalk-java versions prior to 4.2.37.

Affected products (as reported)

VendorProductVersions
SUSE SUSE Manager Server 4.1 spacewalk-java – before 4.1.46
SUSE SUSE Manager Server 4.2 spacewalk-java – before 4.2.37

Weakness: CWE-306, CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References