CVE-2022-21950
Medium
Description
A Improper Access Control vulnerability in the systemd service of cana in openSUSE Backports SLE-15-SP3, openSUSE Backports SLE-15-SP4 allows local users to hijack the UNIX domain socket This issue affects: openSUSE Backports SLE-15-SP3 canna versions prior to canna-3.7p3-bp153.2.3.1. openSUSE Backports SLE-15-SP4 canna versions prior to 3.7p3-bp154.3.3.1. openSUSE Factory was also affected. Instead of fixing the package it was deleted there.
SeverityMedium
CVSS5.3
Exploit probability—
ProductOpensuse Canna
PublishedSep 7, 2022
First seenSep 7, 2022
Weakness typeCWE-284Improper access control
How to fix
Update
- opensuse canna3.7p3-bp153.2.3.1, 3.7p3-bp154.3.3.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| opensuse canna | v < 3.7p3-bp153.2.3.1, v < 3.7p3-bp154.3.3.1, 3.7p3 | 3.7p3-bp153.2.3.1, 3.7p3-bp154.3.3.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.