Log in Start free

Vulnerability · Published Feb 15, 2023 · Assigned by suse

CVE-2022-45153saphanabootstrap-formula: Escalation to root for arbitrary users in hana/ha_cluster.sls

High 7.0

In plain English

A high-severity incorrect default permissions in openSUSE Leap 15.4 from openSUSE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)7.0High
Exploit odds (30 days)0.2%top 87.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An Incorrect Default Permissions vulnerability in saphanabootstrap-formula of SUSE Linux Enterprise Module for SAP Applications 15-SP1, SUSE Linux Enterprise Server for SAP 12-SP5; openSUSE Leap 15.4 allows local attackers to escalate to root by manipulating the sudo configuration that is created. This issue affects: SUSE Linux Enterprise Module for SAP Applications 15-SP1 saphanabootstrap-formula versions prior to 0.13.1+git.1667812208.4db963e. SUSE Linux Enterprise Server for SAP 12-SP5 saphanabootstrap-formula versions prior to 0.13.1+git.1667812208.4db963e. openSUSE Leap 15.4 saphanabootstrap-formula versions prior to 0.13.1+git.1667812208.4db963e.

Affected products (as reported)

VendorProductVersions
SUSE SUSE Linux Enterprise Module for SAP Applications 15-SP1 saphanabootstrap-formula – before 0.13.1+git.1667812208.4db963e
SUSE SUSE Linux Enterprise Server for SAP 12-SP5 saphanabootstrap-formula – before 0.13.1+git.1667812208.4db963e
openSUSE openSUSE Leap 15.4 saphanabootstrap-formula – before 0.13.1+git.1667812208.4db963e

Weakness: CWE-276 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References