CVE-2022-31253
High
Description
A Untrusted Search Path vulnerability in openldap2 of openSUSE Factory allows local attackers with control of the ldap user or group to change ownership of arbitrary directory entries to this user/group, leading to escalation to root. This issue affects: openSUSE Factory openldap2 versions prior to 2.6.3-404.1.
SeverityHigh
CVSS7.1
Exploit probability—
ProductOpensuse Openldap2
PublishedNov 9, 2022
First seenNov 9, 2022
Weakness typeCWE-426CWE-426
How to fix
Update
- opensuse openldap22.6.3-404.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| opensuse openldap2 | v < 2.6.3-404.1 | 2.6.3-404.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.