SUSE update for SUSE Manager Client Tools
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 13 |
| CVE-ID | CVE-2021-36222 CVE-2021-3711 CVE-2021-39226 CVE-2021-41174 CVE-2021-41244 CVE-2021-43798 CVE-2021-43813 CVE-2021-43815 CVE-2022-21673 CVE-2022-21698 CVE-2022-21702 CVE-2022-21703 CVE-2022-21713 |
| CWE-ID | CWE-476 CWE-119 CWE-284 CWE-79 CWE-863 CWE-22 CWE-200 CWE-20 CWE-352 CWE-639 |
| Exploitation vector | Network |
| Public exploit |
Vulnerability #3 is being exploited in the wild. Public exploit code for vulnerability #4 is available. |
| Vulnerable software |
SUSE Manager Tools Operating systems & Components / Operating system SUSE OpenStack Cloud Crowbar Operating systems & Components / Operating system SUSE Linux Enterprise Server for SAP Operating systems & Components / Operating system HPE Helion Openstack Operating systems & Components / Operating system SUSE Linux Enterprise Server Operating systems & Components / Operating system SUSE OpenStack Cloud Operating systems & Components / Operating system suseRegisterInfo Operating systems & Components / Operating system package or component supportutils-plugin-susemanager-client Operating systems & Components / Operating system package or component supportutils-plugin-salt Operating systems & Components / Operating system package or component spacewalk-remote-utils Operating systems & Components / Operating system package or component spacewalk-oscap Operating systems & Components / Operating system package or component spacewalk-koan Operating systems & Components / Operating system package or component spacewalk-client-tools Operating systems & Components / Operating system package or component spacewalk-client-setup Operating systems & Components / Operating system package or component spacewalk-check Operating systems & Components / Operating system package or component spacecmd Operating systems & Components / Operating system package or component python2-suseRegisterInfo Operating systems & Components / Operating system package or component python2-spacewalk-oscap Operating systems & Components / Operating system package or component python2-spacewalk-koan Operating systems & Components / Operating system package or component python2-spacewalk-client-tools Operating systems & Components / Operating system package or component python2-spacewalk-client-setup Operating systems & Components / Operating system package or component python2-spacewalk-check Operating systems & Components / Operating system package or component python2-rhnlib Operating systems & Components / Operating system package or component python2-mgr-virtualization-host Operating systems & Components / Operating system package or component python2-mgr-virtualization-common Operating systems & Components / Operating system package or component python2-mgr-push Operating systems & Components / Operating system package or component python2-mgr-osad Operating systems & Components / Operating system package or component python2-mgr-osa-common Operating systems & Components / Operating system package or component python2-mgr-cfg-management Operating systems & Components / Operating system package or component python2-mgr-cfg-client Operating systems & Components / Operating system package or component python2-mgr-cfg-actions Operating systems & Components / Operating system package or component python2-mgr-cfg Operating systems & Components / Operating system package or component python2-hwdata Operating systems & Components / Operating system package or component mgr-virtualization-host Operating systems & Components / Operating system package or component mgr-push Operating systems & Components / Operating system package or component mgr-osad Operating systems & Components / Operating system package or component mgr-daemon Operating systems & Components / Operating system package or component mgr-custom-info Operating systems & Components / Operating system package or component mgr-cfg-management Operating systems & Components / Operating system package or component mgr-cfg-client Operating systems & Components / Operating system package or component mgr-cfg-actions Operating systems & Components / Operating system package or component mgr-cfg Operating systems & Components / Operating system package or component python2-uyuni-common-libs Operating systems & Components / Operating system package or component prometheus-postgres_exporter Operating systems & Components / Operating system package or component prometheus-blackbox_exporter-debuginfo Operating systems & Components / Operating system package or component prometheus-blackbox_exporter Operating systems & Components / Operating system package or component grafana Operating systems & Components / Operating system package or component golang-github-prometheus-alertmanager Operating systems & Components / Operating system package or component golang-github-QubitProducts-exporter_exporter Operating systems & Components / Operating system package or component golang-github-prometheus-node_exporter Operating systems & Components / Operating system package or component |
| Vendor | SUSE |
Security Bulletin
This security bulletin contains information about 13 vulnerabilities.
1) NULL pointer dereference
EUVDB-ID: #VU55287
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2021-36222
CWE-ID:
CWE-476 - NULL Pointer Dereference
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5). A remote attacker can send a request containing a PA-ENCRYPTED-CHALLENGE padata element without using FAST and perform a denial of service (DoS) attack.
MitigationUpdate the affected package SUSE Manager Client Tools to the latest version.
Vulnerable software versionsSUSE Manager Tools: 12 BETA
SUSE OpenStack Cloud Crowbar: 8 - 9
SUSE Linux Enterprise Server for SAP: 12-SP3 - 12-SP4
HPE Helion Openstack: 8
SUSE Linux Enterprise Server: 12-SP3-LTSS - 12-SP5
SUSE OpenStack Cloud: 8 - 9
suseRegisterInfo: before 4.3.3-25.27.3
supportutils-plugin-susemanager-client: before 4.3.2-6.24.1
supportutils-plugin-salt: before 1.2.0-6.16.1
spacewalk-remote-utils: before 4.3.3-24.24.3
spacewalk-oscap: before 4.3.5-19.27.1
spacewalk-koan: before 4.3.5-24.33.3
spacewalk-client-tools: before 4.3.9-52.71.3
spacewalk-client-setup: before 4.3.9-52.71.3
spacewalk-check: before 4.3.9-52.71.3
spacecmd: before 4.3.11-38.103.3
python2-suseRegisterInfo: before 4.3.3-25.27.3
python2-spacewalk-oscap: before 4.3.5-19.27.1
python2-spacewalk-koan: before 4.3.5-24.33.3
python2-spacewalk-client-tools: before 4.3.9-52.71.3
python2-spacewalk-client-setup: before 4.3.9-52.71.3
python2-spacewalk-check: before 4.3.9-52.71.3
python2-rhnlib: before 4.3.4-21.43.3
python2-mgr-virtualization-host: before 4.3.5-1.29.3
python2-mgr-virtualization-common: before 4.3.5-1.29.3
python2-mgr-push: before 4.3.4-1.21.4
python2-mgr-osad: before 4.3.6-1.39.4
python2-mgr-osa-common: before 4.3.6-1.39.4
python2-mgr-cfg-management: before 4.3.6-1.27.4
python2-mgr-cfg-client: before 4.3.6-1.27.4
python2-mgr-cfg-actions: before 4.3.6-1.27.4
python2-mgr-cfg: before 4.3.6-1.27.4
python2-hwdata: before 2.3.5-12.9.1
mgr-virtualization-host: before 4.3.5-1.29.3
mgr-push: before 4.3.4-1.21.4
mgr-osad: before 4.3.6-1.39.4
mgr-daemon: before 4.3.4-1.32.3
mgr-custom-info: before 4.3.3-1.18.1
mgr-cfg-management: before 4.3.6-1.27.4
mgr-cfg-client: before 4.3.6-1.27.4
mgr-cfg-actions: before 4.3.6-1.27.4
mgr-cfg: before 4.3.6-1.27.4
python2-uyuni-common-libs: before 4.3.4-1.21.3
prometheus-postgres_exporter: before 0.10.0-1.8.2
prometheus-blackbox_exporter-debuginfo: before 0.19.0-1.8.2
prometheus-blackbox_exporter: before 0.19.0-1.8.2
grafana: before 8.3.5-1.30.3
golang-github-prometheus-alertmanager: before 0.23.0-1.12.3
golang-github-QubitProducts-exporter_exporter: before 0.4.0-1.6.1
golang-github-prometheus-node_exporter: before 1.3.0-1.15.3
CPE2.3- cpe:2.3:o:suse:suse_manager_tools:12:BETA:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_openstack_cloud_crowbar:8:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_openstack_cloud_crowbar:9:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:12-SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:12-SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:hpe_helion_openstack:8:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3-BCL:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP4-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_openstack_cloud:8:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suseregisterinfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:supportutils-plugin-susemanager-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:supportutils-plugin-salt:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-remote-utils:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-oscap:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-koan:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-client-tools:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-client-setup:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-check:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacecmd:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-suseregisterinfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-oscap:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-koan:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-client-tools:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-client-setup:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-check:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-rhnlib:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-virtualization-host:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-virtualization-common:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-push:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-osad:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-osa-common:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg-management:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg-actions:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-hwdata:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-virtualization-host:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-push:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-osad:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-daemon:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-custom-info:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg-management:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg-actions:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-uyuni-common-libs:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:prometheus-postgres_exporter:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:prometheus-blackbox_exporter-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:prometheus-blackbox_exporter:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:grafana:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:golang-github-prometheus-alertmanager:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:golang-github-qubitproducts-exporter_exporter:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:golang-github-prometheus-node_exporter:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2022/suse-su-20222134-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Buffer overflow
EUVDB-ID: #VU56063
Risk: High
CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2021-3711
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in EVP_PKEY_decrypt() function within implementation of the SM2 decryption. A remote attacker can send specially crafted SM2 content for decryption to trigger a buffer overflow by 62 bytes and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationUpdate the affected package SUSE Manager Client Tools to the latest version.
Vulnerable software versionsSUSE Manager Tools: 12 BETA
SUSE OpenStack Cloud Crowbar: 8 - 9
SUSE Linux Enterprise Server for SAP: 12-SP3 - 12-SP4
HPE Helion Openstack: 8
SUSE Linux Enterprise Server: 12-SP3-LTSS - 12-SP5
SUSE OpenStack Cloud: 8 - 9
suseRegisterInfo: before 4.3.3-25.27.3
supportutils-plugin-susemanager-client: before 4.3.2-6.24.1
supportutils-plugin-salt: before 1.2.0-6.16.1
spacewalk-remote-utils: before 4.3.3-24.24.3
spacewalk-oscap: before 4.3.5-19.27.1
spacewalk-koan: before 4.3.5-24.33.3
spacewalk-client-tools: before 4.3.9-52.71.3
spacewalk-client-setup: before 4.3.9-52.71.3
spacewalk-check: before 4.3.9-52.71.3
spacecmd: before 4.3.11-38.103.3
python2-suseRegisterInfo: before 4.3.3-25.27.3
python2-spacewalk-oscap: before 4.3.5-19.27.1
python2-spacewalk-koan: before 4.3.5-24.33.3
python2-spacewalk-client-tools: before 4.3.9-52.71.3
python2-spacewalk-client-setup: before 4.3.9-52.71.3
python2-spacewalk-check: before 4.3.9-52.71.3
python2-rhnlib: before 4.3.4-21.43.3
python2-mgr-virtualization-host: before 4.3.5-1.29.3
python2-mgr-virtualization-common: before 4.3.5-1.29.3
python2-mgr-push: before 4.3.4-1.21.4
python2-mgr-osad: before 4.3.6-1.39.4
python2-mgr-osa-common: before 4.3.6-1.39.4
python2-mgr-cfg-management: before 4.3.6-1.27.4
python2-mgr-cfg-client: before 4.3.6-1.27.4
python2-mgr-cfg-actions: before 4.3.6-1.27.4
python2-mgr-cfg: before 4.3.6-1.27.4
python2-hwdata: before 2.3.5-12.9.1
mgr-virtualization-host: before 4.3.5-1.29.3
mgr-push: before 4.3.4-1.21.4
mgr-osad: before 4.3.6-1.39.4
mgr-daemon: before 4.3.4-1.32.3
mgr-custom-info: before 4.3.3-1.18.1
mgr-cfg-management: before 4.3.6-1.27.4
mgr-cfg-client: before 4.3.6-1.27.4
mgr-cfg-actions: before 4.3.6-1.27.4
mgr-cfg: before 4.3.6-1.27.4
python2-uyuni-common-libs: before 4.3.4-1.21.3
prometheus-postgres_exporter: before 0.10.0-1.8.2
prometheus-blackbox_exporter-debuginfo: before 0.19.0-1.8.2
prometheus-blackbox_exporter: before 0.19.0-1.8.2
grafana: before 8.3.5-1.30.3
golang-github-prometheus-alertmanager: before 0.23.0-1.12.3
golang-github-QubitProducts-exporter_exporter: before 0.4.0-1.6.1
golang-github-prometheus-node_exporter: before 1.3.0-1.15.3
CPE2.3- cpe:2.3:o:suse:suse_manager_tools:12:BETA:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_openstack_cloud_crowbar:8:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_openstack_cloud_crowbar:9:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:12-SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:12-SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:hpe_helion_openstack:8:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3-BCL:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP4-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_openstack_cloud:8:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suseregisterinfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:supportutils-plugin-susemanager-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:supportutils-plugin-salt:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-remote-utils:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-oscap:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-koan:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-client-tools:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-client-setup:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-check:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacecmd:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-suseregisterinfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-oscap:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-koan:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-client-tools:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-client-setup:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-check:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-rhnlib:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-virtualization-host:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-virtualization-common:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-push:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-osad:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-osa-common:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg-management:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg-actions:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-hwdata:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-virtualization-host:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-push:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-osad:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-daemon:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-custom-info:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg-management:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg-actions:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-uyuni-common-libs:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:prometheus-postgres_exporter:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:prometheus-blackbox_exporter-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:prometheus-blackbox_exporter:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:grafana:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:golang-github-prometheus-alertmanager:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:golang-github-qubitproducts-exporter_exporter:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:golang-github-prometheus-node_exporter:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2022/suse-su-20222134-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Improper access control
EUVDB-ID: #VU57320
Risk: Medium
CVSSv4.0: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:A/U:Green]
CVE-ID: CVE-2021-39226
CWE-ID:
CWE-284 - Improper Access Control
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions to database snapshots. Remote unauthenticated and authenticated users are able to view the snapshot with the lowest database key by accessing the literal paths: /dashboard/snapshot/:key, or /api/snapshots/:key. If the snapshot "public_mode" configuration setting is set to true (vs default of false), unauthenticated users are able to delete the snapshot with the lowest database key by accessing the literal path: /api/snapshots-delete/:deleteKey.
Regardless of the snapshot "public_mode" setting, authenticated users are able to delete the snapshot with the lowest database key by accessing the literal paths: /api/snapshots/:key, or /api/snapshots-delete/:deleteKey. The combination of deletion and viewing enables a complete walk through all snapshot data while resulting in complete snapshot data loss.
MitigationUpdate the affected package SUSE Manager Client Tools to the latest version.
Vulnerable software versionsSUSE Manager Tools: 12 BETA
SUSE OpenStack Cloud Crowbar: 8 - 9
SUSE Linux Enterprise Server for SAP: 12-SP3 - 12-SP4
HPE Helion Openstack: 8
SUSE Linux Enterprise Server: 12-SP3-LTSS - 12-SP5
SUSE OpenStack Cloud: 8 - 9
suseRegisterInfo: before 4.3.3-25.27.3
supportutils-plugin-susemanager-client: before 4.3.2-6.24.1
supportutils-plugin-salt: before 1.2.0-6.16.1
spacewalk-remote-utils: before 4.3.3-24.24.3
spacewalk-oscap: before 4.3.5-19.27.1
spacewalk-koan: before 4.3.5-24.33.3
spacewalk-client-tools: before 4.3.9-52.71.3
spacewalk-client-setup: before 4.3.9-52.71.3
spacewalk-check: before 4.3.9-52.71.3
spacecmd: before 4.3.11-38.103.3
python2-suseRegisterInfo: before 4.3.3-25.27.3
python2-spacewalk-oscap: before 4.3.5-19.27.1
python2-spacewalk-koan: before 4.3.5-24.33.3
python2-spacewalk-client-tools: before 4.3.9-52.71.3
python2-spacewalk-client-setup: before 4.3.9-52.71.3
python2-spacewalk-check: before 4.3.9-52.71.3
python2-rhnlib: before 4.3.4-21.43.3
python2-mgr-virtualization-host: before 4.3.5-1.29.3
python2-mgr-virtualization-common: before 4.3.5-1.29.3
python2-mgr-push: before 4.3.4-1.21.4
python2-mgr-osad: before 4.3.6-1.39.4
python2-mgr-osa-common: before 4.3.6-1.39.4
python2-mgr-cfg-management: before 4.3.6-1.27.4
python2-mgr-cfg-client: before 4.3.6-1.27.4
python2-mgr-cfg-actions: before 4.3.6-1.27.4
python2-mgr-cfg: before 4.3.6-1.27.4
python2-hwdata: before 2.3.5-12.9.1
mgr-virtualization-host: before 4.3.5-1.29.3
mgr-push: before 4.3.4-1.21.4
mgr-osad: before 4.3.6-1.39.4
mgr-daemon: before 4.3.4-1.32.3
mgr-custom-info: before 4.3.3-1.18.1
mgr-cfg-management: before 4.3.6-1.27.4
mgr-cfg-client: before 4.3.6-1.27.4
mgr-cfg-actions: before 4.3.6-1.27.4
mgr-cfg: before 4.3.6-1.27.4
python2-uyuni-common-libs: before 4.3.4-1.21.3
prometheus-postgres_exporter: before 0.10.0-1.8.2
prometheus-blackbox_exporter-debuginfo: before 0.19.0-1.8.2
prometheus-blackbox_exporter: before 0.19.0-1.8.2
grafana: before 8.3.5-1.30.3
golang-github-prometheus-alertmanager: before 0.23.0-1.12.3
golang-github-QubitProducts-exporter_exporter: before 0.4.0-1.6.1
golang-github-prometheus-node_exporter: before 1.3.0-1.15.3
CPE2.3- cpe:2.3:o:suse:suse_manager_tools:12:BETA:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_openstack_cloud_crowbar:8:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_openstack_cloud_crowbar:9:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:12-SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:12-SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:hpe_helion_openstack:8:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3-BCL:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP4-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_openstack_cloud:8:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suseregisterinfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:supportutils-plugin-susemanager-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:supportutils-plugin-salt:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-remote-utils:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-oscap:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-koan:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-client-tools:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-client-setup:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-check:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacecmd:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-suseregisterinfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-oscap:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-koan:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-client-tools:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-client-setup:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-check:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-rhnlib:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-virtualization-host:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-virtualization-common:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-push:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-osad:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-osa-common:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg-management:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg-actions:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-hwdata:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-virtualization-host:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-push:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-osad:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-daemon:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-custom-info:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg-management:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg-actions:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-uyuni-common-libs:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:prometheus-postgres_exporter:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:prometheus-blackbox_exporter-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:prometheus-blackbox_exporter:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:grafana:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:golang-github-prometheus-alertmanager:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:golang-github-qubitproducts-exporter_exporter:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:golang-github-prometheus-node_exporter:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2022/suse-su-20222134-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
Yes. This vulnerability is being exploited in the wild.
4) Cross-site scripting
EUVDB-ID: #VU57926
Risk: Low
CVSSv4.0: 2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P/U:Clear]
CVE-ID: CVE-2021-41174
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: Yes
DescriptionThe disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationUpdate the affected package SUSE Manager Client Tools to the latest version.
Vulnerable software versionsSUSE Manager Tools: 12 BETA
SUSE OpenStack Cloud Crowbar: 8 - 9
SUSE Linux Enterprise Server for SAP: 12-SP3 - 12-SP4
HPE Helion Openstack: 8
SUSE Linux Enterprise Server: 12-SP3-LTSS - 12-SP5
SUSE OpenStack Cloud: 8 - 9
suseRegisterInfo: before 4.3.3-25.27.3
supportutils-plugin-susemanager-client: before 4.3.2-6.24.1
supportutils-plugin-salt: before 1.2.0-6.16.1
spacewalk-remote-utils: before 4.3.3-24.24.3
spacewalk-oscap: before 4.3.5-19.27.1
spacewalk-koan: before 4.3.5-24.33.3
spacewalk-client-tools: before 4.3.9-52.71.3
spacewalk-client-setup: before 4.3.9-52.71.3
spacewalk-check: before 4.3.9-52.71.3
spacecmd: before 4.3.11-38.103.3
python2-suseRegisterInfo: before 4.3.3-25.27.3
python2-spacewalk-oscap: before 4.3.5-19.27.1
python2-spacewalk-koan: before 4.3.5-24.33.3
python2-spacewalk-client-tools: before 4.3.9-52.71.3
python2-spacewalk-client-setup: before 4.3.9-52.71.3
python2-spacewalk-check: before 4.3.9-52.71.3
python2-rhnlib: before 4.3.4-21.43.3
python2-mgr-virtualization-host: before 4.3.5-1.29.3
python2-mgr-virtualization-common: before 4.3.5-1.29.3
python2-mgr-push: before 4.3.4-1.21.4
python2-mgr-osad: before 4.3.6-1.39.4
python2-mgr-osa-common: before 4.3.6-1.39.4
python2-mgr-cfg-management: before 4.3.6-1.27.4
python2-mgr-cfg-client: before 4.3.6-1.27.4
python2-mgr-cfg-actions: before 4.3.6-1.27.4
python2-mgr-cfg: before 4.3.6-1.27.4
python2-hwdata: before 2.3.5-12.9.1
mgr-virtualization-host: before 4.3.5-1.29.3
mgr-push: before 4.3.4-1.21.4
mgr-osad: before 4.3.6-1.39.4
mgr-daemon: before 4.3.4-1.32.3
mgr-custom-info: before 4.3.3-1.18.1
mgr-cfg-management: before 4.3.6-1.27.4
mgr-cfg-client: before 4.3.6-1.27.4
mgr-cfg-actions: before 4.3.6-1.27.4
mgr-cfg: before 4.3.6-1.27.4
python2-uyuni-common-libs: before 4.3.4-1.21.3
prometheus-postgres_exporter: before 0.10.0-1.8.2
prometheus-blackbox_exporter-debuginfo: before 0.19.0-1.8.2
prometheus-blackbox_exporter: before 0.19.0-1.8.2
grafana: before 8.3.5-1.30.3
golang-github-prometheus-alertmanager: before 0.23.0-1.12.3
golang-github-QubitProducts-exporter_exporter: before 0.4.0-1.6.1
golang-github-prometheus-node_exporter: before 1.3.0-1.15.3
CPE2.3- cpe:2.3:o:suse:suse_manager_tools:12:BETA:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_openstack_cloud_crowbar:8:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_openstack_cloud_crowbar:9:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:12-SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:12-SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:hpe_helion_openstack:8:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3-BCL:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP4-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_openstack_cloud:8:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suseregisterinfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:supportutils-plugin-susemanager-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:supportutils-plugin-salt:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-remote-utils:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-oscap:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-koan:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-client-tools:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-client-setup:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-check:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacecmd:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-suseregisterinfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-oscap:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-koan:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-client-tools:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-client-setup:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-check:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-rhnlib:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-virtualization-host:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-virtualization-common:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-push:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-osad:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-osa-common:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg-management:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg-actions:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-hwdata:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-virtualization-host:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-push:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-osad:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-daemon:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-custom-info:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg-management:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg-actions:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-uyuni-common-libs:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:prometheus-postgres_exporter:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:prometheus-blackbox_exporter-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:prometheus-blackbox_exporter:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:grafana:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:golang-github-prometheus-alertmanager:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:golang-github-qubitproducts-exporter_exporter:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:golang-github-prometheus-node_exporter:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2022/suse-su-20222134-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
5) Incorrect authorization
EUVDB-ID: #VU64430
Risk: Medium
CVSSv4.0: 2.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:U/U:Green]
CVE-ID: CVE-2021-41244
CWE-ID:
CWE-863 - Incorrect Authorization
Exploit availability: No
DescriptionThe vulnerability allows a remote user to execute arbitrary code on the target system.
The vulnerability exists due to improper access control in fine-grained access control feature. A remote user with an admin role in one organization can list, add, remove, and update users’ roles in other organizations in which he is not an admin.
MitigationUpdate the affected package SUSE Manager Client Tools to the latest version.
Vulnerable software versionsSUSE Manager Tools: 12 BETA
SUSE OpenStack Cloud Crowbar: 8 - 9
SUSE Linux Enterprise Server for SAP: 12-SP3 - 12-SP4
HPE Helion Openstack: 8
SUSE Linux Enterprise Server: 12-SP3-LTSS - 12-SP5
SUSE OpenStack Cloud: 8 - 9
suseRegisterInfo: before 4.3.3-25.27.3
supportutils-plugin-susemanager-client: before 4.3.2-6.24.1
supportutils-plugin-salt: before 1.2.0-6.16.1
spacewalk-remote-utils: before 4.3.3-24.24.3
spacewalk-oscap: before 4.3.5-19.27.1
spacewalk-koan: before 4.3.5-24.33.3
spacewalk-client-tools: before 4.3.9-52.71.3
spacewalk-client-setup: before 4.3.9-52.71.3
spacewalk-check: before 4.3.9-52.71.3
spacecmd: before 4.3.11-38.103.3
python2-suseRegisterInfo: before 4.3.3-25.27.3
python2-spacewalk-oscap: before 4.3.5-19.27.1
python2-spacewalk-koan: before 4.3.5-24.33.3
python2-spacewalk-client-tools: before 4.3.9-52.71.3
python2-spacewalk-client-setup: before 4.3.9-52.71.3
python2-spacewalk-check: before 4.3.9-52.71.3
python2-rhnlib: before 4.3.4-21.43.3
python2-mgr-virtualization-host: before 4.3.5-1.29.3
python2-mgr-virtualization-common: before 4.3.5-1.29.3
python2-mgr-push: before 4.3.4-1.21.4
python2-mgr-osad: before 4.3.6-1.39.4
python2-mgr-osa-common: before 4.3.6-1.39.4
python2-mgr-cfg-management: before 4.3.6-1.27.4
python2-mgr-cfg-client: before 4.3.6-1.27.4
python2-mgr-cfg-actions: before 4.3.6-1.27.4
python2-mgr-cfg: before 4.3.6-1.27.4
python2-hwdata: before 2.3.5-12.9.1
mgr-virtualization-host: before 4.3.5-1.29.3
mgr-push: before 4.3.4-1.21.4
mgr-osad: before 4.3.6-1.39.4
mgr-daemon: before 4.3.4-1.32.3
mgr-custom-info: before 4.3.3-1.18.1
mgr-cfg-management: before 4.3.6-1.27.4
mgr-cfg-client: before 4.3.6-1.27.4
mgr-cfg-actions: before 4.3.6-1.27.4
mgr-cfg: before 4.3.6-1.27.4
python2-uyuni-common-libs: before 4.3.4-1.21.3
prometheus-postgres_exporter: before 0.10.0-1.8.2
prometheus-blackbox_exporter-debuginfo: before 0.19.0-1.8.2
prometheus-blackbox_exporter: before 0.19.0-1.8.2
grafana: before 8.3.5-1.30.3
golang-github-prometheus-alertmanager: before 0.23.0-1.12.3
golang-github-QubitProducts-exporter_exporter: before 0.4.0-1.6.1
golang-github-prometheus-node_exporter: before 1.3.0-1.15.3
CPE2.3- cpe:2.3:o:suse:suse_manager_tools:12:BETA:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_openstack_cloud_crowbar:8:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_openstack_cloud_crowbar:9:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:12-SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:12-SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:hpe_helion_openstack:8:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3-BCL:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP4-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_openstack_cloud:8:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suseregisterinfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:supportutils-plugin-susemanager-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:supportutils-plugin-salt:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-remote-utils:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-oscap:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-koan:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-client-tools:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-client-setup:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-check:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacecmd:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-suseregisterinfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-oscap:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-koan:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-client-tools:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-client-setup:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-check:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-rhnlib:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-virtualization-host:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-virtualization-common:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-push:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-osad:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-osa-common:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg-management:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg-actions:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-hwdata:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-virtualization-host:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-push:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-osad:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-daemon:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-custom-info:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg-management:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg-actions:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-uyuni-common-libs:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:prometheus-postgres_exporter:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:prometheus-blackbox_exporter-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:prometheus-blackbox_exporter:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:grafana:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:golang-github-prometheus-alertmanager:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:golang-github-qubitproducts-exporter_exporter:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:golang-github-prometheus-node_exporter:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2022/suse-su-20222134-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
6) Path traversal
EUVDB-ID: #VU58647
Risk: High
CVSSv4.0: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:A/U:Amber]
CVE-ID: CVE-2021-43798
CWE-ID:
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences, passed after the "/public/plugins/" URL. A remote non-authenticated attacker can send a specially crafted HTTP request and read arbitrary files on the system.
MitigationUpdate the affected package SUSE Manager Client Tools to the latest version.
Vulnerable software versionsSUSE Manager Tools: 12 BETA
SUSE OpenStack Cloud Crowbar: 8 - 9
SUSE Linux Enterprise Server for SAP: 12-SP3 - 12-SP4
HPE Helion Openstack: 8
SUSE Linux Enterprise Server: 12-SP3-LTSS - 12-SP5
SUSE OpenStack Cloud: 8 - 9
suseRegisterInfo: before 4.3.3-25.27.3
supportutils-plugin-susemanager-client: before 4.3.2-6.24.1
supportutils-plugin-salt: before 1.2.0-6.16.1
spacewalk-remote-utils: before 4.3.3-24.24.3
spacewalk-oscap: before 4.3.5-19.27.1
spacewalk-koan: before 4.3.5-24.33.3
spacewalk-client-tools: before 4.3.9-52.71.3
spacewalk-client-setup: before 4.3.9-52.71.3
spacewalk-check: before 4.3.9-52.71.3
spacecmd: before 4.3.11-38.103.3
python2-suseRegisterInfo: before 4.3.3-25.27.3
python2-spacewalk-oscap: before 4.3.5-19.27.1
python2-spacewalk-koan: before 4.3.5-24.33.3
python2-spacewalk-client-tools: before 4.3.9-52.71.3
python2-spacewalk-client-setup: before 4.3.9-52.71.3
python2-spacewalk-check: before 4.3.9-52.71.3
python2-rhnlib: before 4.3.4-21.43.3
python2-mgr-virtualization-host: before 4.3.5-1.29.3
python2-mgr-virtualization-common: before 4.3.5-1.29.3
python2-mgr-push: before 4.3.4-1.21.4
python2-mgr-osad: before 4.3.6-1.39.4
python2-mgr-osa-common: before 4.3.6-1.39.4
python2-mgr-cfg-management: before 4.3.6-1.27.4
python2-mgr-cfg-client: before 4.3.6-1.27.4
python2-mgr-cfg-actions: before 4.3.6-1.27.4
python2-mgr-cfg: before 4.3.6-1.27.4
python2-hwdata: before 2.3.5-12.9.1
mgr-virtualization-host: before 4.3.5-1.29.3
mgr-push: before 4.3.4-1.21.4
mgr-osad: before 4.3.6-1.39.4
mgr-daemon: before 4.3.4-1.32.3
mgr-custom-info: before 4.3.3-1.18.1
mgr-cfg-management: before 4.3.6-1.27.4
mgr-cfg-client: before 4.3.6-1.27.4
mgr-cfg-actions: before 4.3.6-1.27.4
mgr-cfg: before 4.3.6-1.27.4
python2-uyuni-common-libs: before 4.3.4-1.21.3
prometheus-postgres_exporter: before 0.10.0-1.8.2
prometheus-blackbox_exporter-debuginfo: before 0.19.0-1.8.2
prometheus-blackbox_exporter: before 0.19.0-1.8.2
grafana: before 8.3.5-1.30.3
golang-github-prometheus-alertmanager: before 0.23.0-1.12.3
golang-github-QubitProducts-exporter_exporter: before 0.4.0-1.6.1
golang-github-prometheus-node_exporter: before 1.3.0-1.15.3
CPE2.3- cpe:2.3:o:suse:suse_manager_tools:12:BETA:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_openstack_cloud_crowbar:8:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_openstack_cloud_crowbar:9:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:12-SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:12-SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:hpe_helion_openstack:8:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3-BCL:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP4-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_openstack_cloud:8:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suseregisterinfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:supportutils-plugin-susemanager-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:supportutils-plugin-salt:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-remote-utils:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-oscap:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-koan:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-client-tools:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-client-setup:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-check:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacecmd:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-suseregisterinfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-oscap:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-koan:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-client-tools:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-client-setup:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-check:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-rhnlib:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-virtualization-host:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-virtualization-common:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-push:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-osad:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-osa-common:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg-management:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg-actions:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-hwdata:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-virtualization-host:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-push:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-osad:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-daemon:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-custom-info:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg-management:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg-actions:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-uyuni-common-libs:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:prometheus-postgres_exporter:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:prometheus-blackbox_exporter-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:prometheus-blackbox_exporter:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:grafana:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:golang-github-prometheus-alertmanager:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:golang-github-qubitproducts-exporter_exporter:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:golang-github-prometheus-node_exporter:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2022/suse-su-20222134-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
7) Path traversal
EUVDB-ID: #VU64273
Risk: Low
CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-43813
CWE-ID:
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.
MitigationUpdate the affected package SUSE Manager Client Tools to the latest version.
Vulnerable software versionsSUSE Manager Tools: 12 BETA
SUSE OpenStack Cloud Crowbar: 8 - 9
SUSE Linux Enterprise Server for SAP: 12-SP3 - 12-SP4
HPE Helion Openstack: 8
SUSE Linux Enterprise Server: 12-SP3-LTSS - 12-SP5
SUSE OpenStack Cloud: 8 - 9
suseRegisterInfo: before 4.3.3-25.27.3
supportutils-plugin-susemanager-client: before 4.3.2-6.24.1
supportutils-plugin-salt: before 1.2.0-6.16.1
spacewalk-remote-utils: before 4.3.3-24.24.3
spacewalk-oscap: before 4.3.5-19.27.1
spacewalk-koan: before 4.3.5-24.33.3
spacewalk-client-tools: before 4.3.9-52.71.3
spacewalk-client-setup: before 4.3.9-52.71.3
spacewalk-check: before 4.3.9-52.71.3
spacecmd: before 4.3.11-38.103.3
python2-suseRegisterInfo: before 4.3.3-25.27.3
python2-spacewalk-oscap: before 4.3.5-19.27.1
python2-spacewalk-koan: before 4.3.5-24.33.3
python2-spacewalk-client-tools: before 4.3.9-52.71.3
python2-spacewalk-client-setup: before 4.3.9-52.71.3
python2-spacewalk-check: before 4.3.9-52.71.3
python2-rhnlib: before 4.3.4-21.43.3
python2-mgr-virtualization-host: before 4.3.5-1.29.3
python2-mgr-virtualization-common: before 4.3.5-1.29.3
python2-mgr-push: before 4.3.4-1.21.4
python2-mgr-osad: before 4.3.6-1.39.4
python2-mgr-osa-common: before 4.3.6-1.39.4
python2-mgr-cfg-management: before 4.3.6-1.27.4
python2-mgr-cfg-client: before 4.3.6-1.27.4
python2-mgr-cfg-actions: before 4.3.6-1.27.4
python2-mgr-cfg: before 4.3.6-1.27.4
python2-hwdata: before 2.3.5-12.9.1
mgr-virtualization-host: before 4.3.5-1.29.3
mgr-push: before 4.3.4-1.21.4
mgr-osad: before 4.3.6-1.39.4
mgr-daemon: before 4.3.4-1.32.3
mgr-custom-info: before 4.3.3-1.18.1
mgr-cfg-management: before 4.3.6-1.27.4
mgr-cfg-client: before 4.3.6-1.27.4
mgr-cfg-actions: before 4.3.6-1.27.4
mgr-cfg: before 4.3.6-1.27.4
python2-uyuni-common-libs: before 4.3.4-1.21.3
prometheus-postgres_exporter: before 0.10.0-1.8.2
prometheus-blackbox_exporter-debuginfo: before 0.19.0-1.8.2
prometheus-blackbox_exporter: before 0.19.0-1.8.2
grafana: before 8.3.5-1.30.3
golang-github-prometheus-alertmanager: before 0.23.0-1.12.3
golang-github-QubitProducts-exporter_exporter: before 0.4.0-1.6.1
golang-github-prometheus-node_exporter: before 1.3.0-1.15.3
CPE2.3- cpe:2.3:o:suse:suse_manager_tools:12:BETA:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_openstack_cloud_crowbar:8:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_openstack_cloud_crowbar:9:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:12-SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:12-SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:hpe_helion_openstack:8:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3-BCL:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP4-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_openstack_cloud:8:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suseregisterinfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:supportutils-plugin-susemanager-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:supportutils-plugin-salt:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-remote-utils:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-oscap:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-koan:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-client-tools:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-client-setup:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-check:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacecmd:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-suseregisterinfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-oscap:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-koan:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-client-tools:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-client-setup:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-check:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-rhnlib:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-virtualization-host:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-virtualization-common:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-push:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-osad:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-osa-common:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg-management:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg-actions:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-hwdata:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-virtualization-host:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-push:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-osad:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-daemon:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-custom-info:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg-management:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg-actions:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-uyuni-common-libs:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:prometheus-postgres_exporter:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:prometheus-blackbox_exporter-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:prometheus-blackbox_exporter:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:grafana:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:golang-github-prometheus-alertmanager:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:golang-github-qubitproducts-exporter_exporter:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:golang-github-prometheus-node_exporter:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2022/suse-su-20222134-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
8) Path traversal
EUVDB-ID: #VU64404
Risk: Low
CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2021-43815
CWE-ID:
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Exploit availability: No
DescriptionThe vulnerability allows a remote user to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing .csv files. A remote user can send a specially crafted HTTP request and read arbitrary files on the system.
MitigationUpdate the affected package SUSE Manager Client Tools to the latest version.
Vulnerable software versionsSUSE Manager Tools: 12 BETA
SUSE OpenStack Cloud Crowbar: 8 - 9
SUSE Linux Enterprise Server for SAP: 12-SP3 - 12-SP4
HPE Helion Openstack: 8
SUSE Linux Enterprise Server: 12-SP3-LTSS - 12-SP5
SUSE OpenStack Cloud: 8 - 9
suseRegisterInfo: before 4.3.3-25.27.3
supportutils-plugin-susemanager-client: before 4.3.2-6.24.1
supportutils-plugin-salt: before 1.2.0-6.16.1
spacewalk-remote-utils: before 4.3.3-24.24.3
spacewalk-oscap: before 4.3.5-19.27.1
spacewalk-koan: before 4.3.5-24.33.3
spacewalk-client-tools: before 4.3.9-52.71.3
spacewalk-client-setup: before 4.3.9-52.71.3
spacewalk-check: before 4.3.9-52.71.3
spacecmd: before 4.3.11-38.103.3
python2-suseRegisterInfo: before 4.3.3-25.27.3
python2-spacewalk-oscap: before 4.3.5-19.27.1
python2-spacewalk-koan: before 4.3.5-24.33.3
python2-spacewalk-client-tools: before 4.3.9-52.71.3
python2-spacewalk-client-setup: before 4.3.9-52.71.3
python2-spacewalk-check: before 4.3.9-52.71.3
python2-rhnlib: before 4.3.4-21.43.3
python2-mgr-virtualization-host: before 4.3.5-1.29.3
python2-mgr-virtualization-common: before 4.3.5-1.29.3
python2-mgr-push: before 4.3.4-1.21.4
python2-mgr-osad: before 4.3.6-1.39.4
python2-mgr-osa-common: before 4.3.6-1.39.4
python2-mgr-cfg-management: before 4.3.6-1.27.4
python2-mgr-cfg-client: before 4.3.6-1.27.4
python2-mgr-cfg-actions: before 4.3.6-1.27.4
python2-mgr-cfg: before 4.3.6-1.27.4
python2-hwdata: before 2.3.5-12.9.1
mgr-virtualization-host: before 4.3.5-1.29.3
mgr-push: before 4.3.4-1.21.4
mgr-osad: before 4.3.6-1.39.4
mgr-daemon: before 4.3.4-1.32.3
mgr-custom-info: before 4.3.3-1.18.1
mgr-cfg-management: before 4.3.6-1.27.4
mgr-cfg-client: before 4.3.6-1.27.4
mgr-cfg-actions: before 4.3.6-1.27.4
mgr-cfg: before 4.3.6-1.27.4
python2-uyuni-common-libs: before 4.3.4-1.21.3
prometheus-postgres_exporter: before 0.10.0-1.8.2
prometheus-blackbox_exporter-debuginfo: before 0.19.0-1.8.2
prometheus-blackbox_exporter: before 0.19.0-1.8.2
grafana: before 8.3.5-1.30.3
golang-github-prometheus-alertmanager: before 0.23.0-1.12.3
golang-github-QubitProducts-exporter_exporter: before 0.4.0-1.6.1
golang-github-prometheus-node_exporter: before 1.3.0-1.15.3
CPE2.3- cpe:2.3:o:suse:suse_manager_tools:12:BETA:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_openstack_cloud_crowbar:8:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_openstack_cloud_crowbar:9:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:12-SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:12-SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:hpe_helion_openstack:8:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3-BCL:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP4-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_openstack_cloud:8:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suseregisterinfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:supportutils-plugin-susemanager-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:supportutils-plugin-salt:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-remote-utils:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-oscap:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-koan:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-client-tools:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-client-setup:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-check:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacecmd:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-suseregisterinfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-oscap:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-koan:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-client-tools:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-client-setup:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-check:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-rhnlib:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-virtualization-host:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-virtualization-common:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-push:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-osad:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-osa-common:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg-management:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg-actions:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-hwdata:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-virtualization-host:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-push:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-osad:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-daemon:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-custom-info:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg-management:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg-actions:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-uyuni-common-libs:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:prometheus-postgres_exporter:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:prometheus-blackbox_exporter-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:prometheus-blackbox_exporter:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:grafana:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:golang-github-prometheus-alertmanager:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:golang-github-qubitproducts-exporter_exporter:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:golang-github-prometheus-node_exporter:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2022/suse-su-20222134-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
9) Information disclosure
EUVDB-ID: #VU64402
Risk: Low
CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-21673
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a remote user to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application. A remote user can pass a specially crafted query to the data source with an API token and Forward OAuth Identity feature enabled to gain unauthorized access to sensitive information on the system.
MitigationUpdate the affected package SUSE Manager Client Tools to the latest version.
Vulnerable software versionsSUSE Manager Tools: 12 BETA
SUSE OpenStack Cloud Crowbar: 8 - 9
SUSE Linux Enterprise Server for SAP: 12-SP3 - 12-SP4
HPE Helion Openstack: 8
SUSE Linux Enterprise Server: 12-SP3-LTSS - 12-SP5
SUSE OpenStack Cloud: 8 - 9
suseRegisterInfo: before 4.3.3-25.27.3
supportutils-plugin-susemanager-client: before 4.3.2-6.24.1
supportutils-plugin-salt: before 1.2.0-6.16.1
spacewalk-remote-utils: before 4.3.3-24.24.3
spacewalk-oscap: before 4.3.5-19.27.1
spacewalk-koan: before 4.3.5-24.33.3
spacewalk-client-tools: before 4.3.9-52.71.3
spacewalk-client-setup: before 4.3.9-52.71.3
spacewalk-check: before 4.3.9-52.71.3
spacecmd: before 4.3.11-38.103.3
python2-suseRegisterInfo: before 4.3.3-25.27.3
python2-spacewalk-oscap: before 4.3.5-19.27.1
python2-spacewalk-koan: before 4.3.5-24.33.3
python2-spacewalk-client-tools: before 4.3.9-52.71.3
python2-spacewalk-client-setup: before 4.3.9-52.71.3
python2-spacewalk-check: before 4.3.9-52.71.3
python2-rhnlib: before 4.3.4-21.43.3
python2-mgr-virtualization-host: before 4.3.5-1.29.3
python2-mgr-virtualization-common: before 4.3.5-1.29.3
python2-mgr-push: before 4.3.4-1.21.4
python2-mgr-osad: before 4.3.6-1.39.4
python2-mgr-osa-common: before 4.3.6-1.39.4
python2-mgr-cfg-management: before 4.3.6-1.27.4
python2-mgr-cfg-client: before 4.3.6-1.27.4
python2-mgr-cfg-actions: before 4.3.6-1.27.4
python2-mgr-cfg: before 4.3.6-1.27.4
python2-hwdata: before 2.3.5-12.9.1
mgr-virtualization-host: before 4.3.5-1.29.3
mgr-push: before 4.3.4-1.21.4
mgr-osad: before 4.3.6-1.39.4
mgr-daemon: before 4.3.4-1.32.3
mgr-custom-info: before 4.3.3-1.18.1
mgr-cfg-management: before 4.3.6-1.27.4
mgr-cfg-client: before 4.3.6-1.27.4
mgr-cfg-actions: before 4.3.6-1.27.4
mgr-cfg: before 4.3.6-1.27.4
python2-uyuni-common-libs: before 4.3.4-1.21.3
prometheus-postgres_exporter: before 0.10.0-1.8.2
prometheus-blackbox_exporter-debuginfo: before 0.19.0-1.8.2
prometheus-blackbox_exporter: before 0.19.0-1.8.2
grafana: before 8.3.5-1.30.3
golang-github-prometheus-alertmanager: before 0.23.0-1.12.3
golang-github-QubitProducts-exporter_exporter: before 0.4.0-1.6.1
golang-github-prometheus-node_exporter: before 1.3.0-1.15.3
CPE2.3- cpe:2.3:o:suse:suse_manager_tools:12:BETA:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_openstack_cloud_crowbar:8:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_openstack_cloud_crowbar:9:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:12-SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:12-SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:hpe_helion_openstack:8:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3-BCL:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP4-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_openstack_cloud:8:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suseregisterinfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:supportutils-plugin-susemanager-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:supportutils-plugin-salt:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-remote-utils:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-oscap:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-koan:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-client-tools:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-client-setup:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-check:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacecmd:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-suseregisterinfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-oscap:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-koan:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-client-tools:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-client-setup:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-check:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-rhnlib:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-virtualization-host:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-virtualization-common:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-push:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-osad:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-osa-common:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg-management:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg-actions:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-hwdata:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-virtualization-host:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-push:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-osad:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-daemon:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-custom-info:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg-management:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg-actions:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-uyuni-common-libs:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:prometheus-postgres_exporter:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:prometheus-blackbox_exporter-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:prometheus-blackbox_exporter:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:grafana:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:golang-github-prometheus-alertmanager:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:golang-github-qubitproducts-exporter_exporter:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:golang-github-prometheus-node_exporter:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2022/suse-su-20222134-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
10) Input validation error
EUVDB-ID: #VU61599
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2022-21698
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input within method label cardinality. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
MitigationUpdate the affected package SUSE Manager Client Tools to the latest version.
Vulnerable software versionsSUSE Manager Tools: 12 BETA
SUSE OpenStack Cloud Crowbar: 8 - 9
SUSE Linux Enterprise Server for SAP: 12-SP3 - 12-SP4
HPE Helion Openstack: 8
SUSE Linux Enterprise Server: 12-SP3-LTSS - 12-SP5
SUSE OpenStack Cloud: 8 - 9
suseRegisterInfo: before 4.3.3-25.27.3
supportutils-plugin-susemanager-client: before 4.3.2-6.24.1
supportutils-plugin-salt: before 1.2.0-6.16.1
spacewalk-remote-utils: before 4.3.3-24.24.3
spacewalk-oscap: before 4.3.5-19.27.1
spacewalk-koan: before 4.3.5-24.33.3
spacewalk-client-tools: before 4.3.9-52.71.3
spacewalk-client-setup: before 4.3.9-52.71.3
spacewalk-check: before 4.3.9-52.71.3
spacecmd: before 4.3.11-38.103.3
python2-suseRegisterInfo: before 4.3.3-25.27.3
python2-spacewalk-oscap: before 4.3.5-19.27.1
python2-spacewalk-koan: before 4.3.5-24.33.3
python2-spacewalk-client-tools: before 4.3.9-52.71.3
python2-spacewalk-client-setup: before 4.3.9-52.71.3
python2-spacewalk-check: before 4.3.9-52.71.3
python2-rhnlib: before 4.3.4-21.43.3
python2-mgr-virtualization-host: before 4.3.5-1.29.3
python2-mgr-virtualization-common: before 4.3.5-1.29.3
python2-mgr-push: before 4.3.4-1.21.4
python2-mgr-osad: before 4.3.6-1.39.4
python2-mgr-osa-common: before 4.3.6-1.39.4
python2-mgr-cfg-management: before 4.3.6-1.27.4
python2-mgr-cfg-client: before 4.3.6-1.27.4
python2-mgr-cfg-actions: before 4.3.6-1.27.4
python2-mgr-cfg: before 4.3.6-1.27.4
python2-hwdata: before 2.3.5-12.9.1
mgr-virtualization-host: before 4.3.5-1.29.3
mgr-push: before 4.3.4-1.21.4
mgr-osad: before 4.3.6-1.39.4
mgr-daemon: before 4.3.4-1.32.3
mgr-custom-info: before 4.3.3-1.18.1
mgr-cfg-management: before 4.3.6-1.27.4
mgr-cfg-client: before 4.3.6-1.27.4
mgr-cfg-actions: before 4.3.6-1.27.4
mgr-cfg: before 4.3.6-1.27.4
python2-uyuni-common-libs: before 4.3.4-1.21.3
prometheus-postgres_exporter: before 0.10.0-1.8.2
prometheus-blackbox_exporter-debuginfo: before 0.19.0-1.8.2
prometheus-blackbox_exporter: before 0.19.0-1.8.2
grafana: before 8.3.5-1.30.3
golang-github-prometheus-alertmanager: before 0.23.0-1.12.3
golang-github-QubitProducts-exporter_exporter: before 0.4.0-1.6.1
golang-github-prometheus-node_exporter: before 1.3.0-1.15.3
CPE2.3- cpe:2.3:o:suse:suse_manager_tools:12:BETA:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_openstack_cloud_crowbar:8:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_openstack_cloud_crowbar:9:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:12-SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:12-SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:hpe_helion_openstack:8:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3-BCL:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP4-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_openstack_cloud:8:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suseregisterinfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:supportutils-plugin-susemanager-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:supportutils-plugin-salt:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-remote-utils:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-oscap:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-koan:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-client-tools:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-client-setup:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-check:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacecmd:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-suseregisterinfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-oscap:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-koan:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-client-tools:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-client-setup:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-check:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-rhnlib:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-virtualization-host:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-virtualization-common:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-push:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-osad:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-osa-common:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg-management:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg-actions:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-hwdata:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-virtualization-host:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-push:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-osad:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-daemon:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-custom-info:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg-management:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg-actions:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-uyuni-common-libs:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:prometheus-postgres_exporter:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:prometheus-blackbox_exporter-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:prometheus-blackbox_exporter:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:grafana:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:golang-github-prometheus-alertmanager:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:golang-github-qubitproducts-exporter_exporter:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:golang-github-prometheus-node_exporter:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2022/suse-su-20222134-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
11) Cross-site scripting
EUVDB-ID: #VU64397
Risk: Low
CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-21702
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: No
DescriptionThe disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in Grafana. A remote attacker can trick the victim to visit a specially crafted link, execute arbitrary HTML code, and perform a Cross-site scripting (XSS) attack.
Update the affected package SUSE Manager Client Tools to the latest version.
Vulnerable software versionsSUSE Manager Tools: 12 BETA
SUSE OpenStack Cloud Crowbar: 8 - 9
SUSE Linux Enterprise Server for SAP: 12-SP3 - 12-SP4
HPE Helion Openstack: 8
SUSE Linux Enterprise Server: 12-SP3-LTSS - 12-SP5
SUSE OpenStack Cloud: 8 - 9
suseRegisterInfo: before 4.3.3-25.27.3
supportutils-plugin-susemanager-client: before 4.3.2-6.24.1
supportutils-plugin-salt: before 1.2.0-6.16.1
spacewalk-remote-utils: before 4.3.3-24.24.3
spacewalk-oscap: before 4.3.5-19.27.1
spacewalk-koan: before 4.3.5-24.33.3
spacewalk-client-tools: before 4.3.9-52.71.3
spacewalk-client-setup: before 4.3.9-52.71.3
spacewalk-check: before 4.3.9-52.71.3
spacecmd: before 4.3.11-38.103.3
python2-suseRegisterInfo: before 4.3.3-25.27.3
python2-spacewalk-oscap: before 4.3.5-19.27.1
python2-spacewalk-koan: before 4.3.5-24.33.3
python2-spacewalk-client-tools: before 4.3.9-52.71.3
python2-spacewalk-client-setup: before 4.3.9-52.71.3
python2-spacewalk-check: before 4.3.9-52.71.3
python2-rhnlib: before 4.3.4-21.43.3
python2-mgr-virtualization-host: before 4.3.5-1.29.3
python2-mgr-virtualization-common: before 4.3.5-1.29.3
python2-mgr-push: before 4.3.4-1.21.4
python2-mgr-osad: before 4.3.6-1.39.4
python2-mgr-osa-common: before 4.3.6-1.39.4
python2-mgr-cfg-management: before 4.3.6-1.27.4
python2-mgr-cfg-client: before 4.3.6-1.27.4
python2-mgr-cfg-actions: before 4.3.6-1.27.4
python2-mgr-cfg: before 4.3.6-1.27.4
python2-hwdata: before 2.3.5-12.9.1
mgr-virtualization-host: before 4.3.5-1.29.3
mgr-push: before 4.3.4-1.21.4
mgr-osad: before 4.3.6-1.39.4
mgr-daemon: before 4.3.4-1.32.3
mgr-custom-info: before 4.3.3-1.18.1
mgr-cfg-management: before 4.3.6-1.27.4
mgr-cfg-client: before 4.3.6-1.27.4
mgr-cfg-actions: before 4.3.6-1.27.4
mgr-cfg: before 4.3.6-1.27.4
python2-uyuni-common-libs: before 4.3.4-1.21.3
prometheus-postgres_exporter: before 0.10.0-1.8.2
prometheus-blackbox_exporter-debuginfo: before 0.19.0-1.8.2
prometheus-blackbox_exporter: before 0.19.0-1.8.2
grafana: before 8.3.5-1.30.3
golang-github-prometheus-alertmanager: before 0.23.0-1.12.3
golang-github-QubitProducts-exporter_exporter: before 0.4.0-1.6.1
golang-github-prometheus-node_exporter: before 1.3.0-1.15.3
CPE2.3- cpe:2.3:o:suse:suse_manager_tools:12:BETA:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_openstack_cloud_crowbar:8:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_openstack_cloud_crowbar:9:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:12-SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:12-SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:hpe_helion_openstack:8:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3-BCL:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP4-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_openstack_cloud:8:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suseregisterinfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:supportutils-plugin-susemanager-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:supportutils-plugin-salt:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-remote-utils:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-oscap:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-koan:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-client-tools:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-client-setup:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-check:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacecmd:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-suseregisterinfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-oscap:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-koan:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-client-tools:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-client-setup:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-check:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-rhnlib:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-virtualization-host:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-virtualization-common:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-push:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-osad:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-osa-common:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg-management:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg-actions:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-hwdata:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-virtualization-host:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-push:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-osad:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-daemon:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-custom-info:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg-management:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg-actions:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-uyuni-common-libs:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:prometheus-postgres_exporter:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:prometheus-blackbox_exporter-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:prometheus-blackbox_exporter:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:grafana:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:golang-github-prometheus-alertmanager:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:golang-github-qubitproducts-exporter_exporter:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:golang-github-prometheus-node_exporter:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2022/suse-su-20222134-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
12) Cross-site request forgery
EUVDB-ID: #VU64399
Risk: Medium
CVSSv4.0: 4.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2022-21703
CWE-ID:
CWE-352 - Cross-Site Request Forgery (CSRF)
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform cross-site request forgery attacks.
The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim into inviting the attacker as a new user with high privileges to escalate privileges.
Update the affected package SUSE Manager Client Tools to the latest version.
Vulnerable software versionsSUSE Manager Tools: 12 BETA
SUSE OpenStack Cloud Crowbar: 8 - 9
SUSE Linux Enterprise Server for SAP: 12-SP3 - 12-SP4
HPE Helion Openstack: 8
SUSE Linux Enterprise Server: 12-SP3-LTSS - 12-SP5
SUSE OpenStack Cloud: 8 - 9
suseRegisterInfo: before 4.3.3-25.27.3
supportutils-plugin-susemanager-client: before 4.3.2-6.24.1
supportutils-plugin-salt: before 1.2.0-6.16.1
spacewalk-remote-utils: before 4.3.3-24.24.3
spacewalk-oscap: before 4.3.5-19.27.1
spacewalk-koan: before 4.3.5-24.33.3
spacewalk-client-tools: before 4.3.9-52.71.3
spacewalk-client-setup: before 4.3.9-52.71.3
spacewalk-check: before 4.3.9-52.71.3
spacecmd: before 4.3.11-38.103.3
python2-suseRegisterInfo: before 4.3.3-25.27.3
python2-spacewalk-oscap: before 4.3.5-19.27.1
python2-spacewalk-koan: before 4.3.5-24.33.3
python2-spacewalk-client-tools: before 4.3.9-52.71.3
python2-spacewalk-client-setup: before 4.3.9-52.71.3
python2-spacewalk-check: before 4.3.9-52.71.3
python2-rhnlib: before 4.3.4-21.43.3
python2-mgr-virtualization-host: before 4.3.5-1.29.3
python2-mgr-virtualization-common: before 4.3.5-1.29.3
python2-mgr-push: before 4.3.4-1.21.4
python2-mgr-osad: before 4.3.6-1.39.4
python2-mgr-osa-common: before 4.3.6-1.39.4
python2-mgr-cfg-management: before 4.3.6-1.27.4
python2-mgr-cfg-client: before 4.3.6-1.27.4
python2-mgr-cfg-actions: before 4.3.6-1.27.4
python2-mgr-cfg: before 4.3.6-1.27.4
python2-hwdata: before 2.3.5-12.9.1
mgr-virtualization-host: before 4.3.5-1.29.3
mgr-push: before 4.3.4-1.21.4
mgr-osad: before 4.3.6-1.39.4
mgr-daemon: before 4.3.4-1.32.3
mgr-custom-info: before 4.3.3-1.18.1
mgr-cfg-management: before 4.3.6-1.27.4
mgr-cfg-client: before 4.3.6-1.27.4
mgr-cfg-actions: before 4.3.6-1.27.4
mgr-cfg: before 4.3.6-1.27.4
python2-uyuni-common-libs: before 4.3.4-1.21.3
prometheus-postgres_exporter: before 0.10.0-1.8.2
prometheus-blackbox_exporter-debuginfo: before 0.19.0-1.8.2
prometheus-blackbox_exporter: before 0.19.0-1.8.2
grafana: before 8.3.5-1.30.3
golang-github-prometheus-alertmanager: before 0.23.0-1.12.3
golang-github-QubitProducts-exporter_exporter: before 0.4.0-1.6.1
golang-github-prometheus-node_exporter: before 1.3.0-1.15.3
CPE2.3- cpe:2.3:o:suse:suse_manager_tools:12:BETA:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_openstack_cloud_crowbar:8:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_openstack_cloud_crowbar:9:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:12-SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:12-SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:hpe_helion_openstack:8:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3-BCL:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP4-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_openstack_cloud:8:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suseregisterinfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:supportutils-plugin-susemanager-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:supportutils-plugin-salt:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-remote-utils:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-oscap:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-koan:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-client-tools:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-client-setup:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-check:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacecmd:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-suseregisterinfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-oscap:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-koan:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-client-tools:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-client-setup:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-check:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-rhnlib:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-virtualization-host:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-virtualization-common:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-push:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-osad:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-osa-common:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg-management:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg-actions:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-hwdata:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-virtualization-host:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-push:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-osad:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-daemon:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-custom-info:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg-management:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg-actions:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-uyuni-common-libs:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:prometheus-postgres_exporter:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:prometheus-blackbox_exporter-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:prometheus-blackbox_exporter:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:grafana:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:golang-github-prometheus-alertmanager:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:golang-github-qubitproducts-exporter_exporter:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:golang-github-prometheus-node_exporter:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2022/suse-su-20222134-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
13) Authorization bypass through user-controlled key
EUVDB-ID: #VU64394
Risk: Low
CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-21713
CWE-ID:
CWE-639 - Authorization Bypass Through User-Controlled Key
Exploit availability: No
DescriptionThe vulnerability allows a remote user to gain access to sensitive information.
The vulnerability exists due to an Insecure Direct Object Reference (IDOR) error in Grafana Teams APIs. A remote authenticated user can view unintended data by querying for the specific team ID or search for teams and see the total number of available teams.
MitigationUpdate the affected package SUSE Manager Client Tools to the latest version.
Vulnerable software versionsSUSE Manager Tools: 12 BETA
SUSE OpenStack Cloud Crowbar: 8 - 9
SUSE Linux Enterprise Server for SAP: 12-SP3 - 12-SP4
HPE Helion Openstack: 8
SUSE Linux Enterprise Server: 12-SP3-LTSS - 12-SP5
SUSE OpenStack Cloud: 8 - 9
suseRegisterInfo: before 4.3.3-25.27.3
supportutils-plugin-susemanager-client: before 4.3.2-6.24.1
supportutils-plugin-salt: before 1.2.0-6.16.1
spacewalk-remote-utils: before 4.3.3-24.24.3
spacewalk-oscap: before 4.3.5-19.27.1
spacewalk-koan: before 4.3.5-24.33.3
spacewalk-client-tools: before 4.3.9-52.71.3
spacewalk-client-setup: before 4.3.9-52.71.3
spacewalk-check: before 4.3.9-52.71.3
spacecmd: before 4.3.11-38.103.3
python2-suseRegisterInfo: before 4.3.3-25.27.3
python2-spacewalk-oscap: before 4.3.5-19.27.1
python2-spacewalk-koan: before 4.3.5-24.33.3
python2-spacewalk-client-tools: before 4.3.9-52.71.3
python2-spacewalk-client-setup: before 4.3.9-52.71.3
python2-spacewalk-check: before 4.3.9-52.71.3
python2-rhnlib: before 4.3.4-21.43.3
python2-mgr-virtualization-host: before 4.3.5-1.29.3
python2-mgr-virtualization-common: before 4.3.5-1.29.3
python2-mgr-push: before 4.3.4-1.21.4
python2-mgr-osad: before 4.3.6-1.39.4
python2-mgr-osa-common: before 4.3.6-1.39.4
python2-mgr-cfg-management: before 4.3.6-1.27.4
python2-mgr-cfg-client: before 4.3.6-1.27.4
python2-mgr-cfg-actions: before 4.3.6-1.27.4
python2-mgr-cfg: before 4.3.6-1.27.4
python2-hwdata: before 2.3.5-12.9.1
mgr-virtualization-host: before 4.3.5-1.29.3
mgr-push: before 4.3.4-1.21.4
mgr-osad: before 4.3.6-1.39.4
mgr-daemon: before 4.3.4-1.32.3
mgr-custom-info: before 4.3.3-1.18.1
mgr-cfg-management: before 4.3.6-1.27.4
mgr-cfg-client: before 4.3.6-1.27.4
mgr-cfg-actions: before 4.3.6-1.27.4
mgr-cfg: before 4.3.6-1.27.4
python2-uyuni-common-libs: before 4.3.4-1.21.3
prometheus-postgres_exporter: before 0.10.0-1.8.2
prometheus-blackbox_exporter-debuginfo: before 0.19.0-1.8.2
prometheus-blackbox_exporter: before 0.19.0-1.8.2
grafana: before 8.3.5-1.30.3
golang-github-prometheus-alertmanager: before 0.23.0-1.12.3
golang-github-QubitProducts-exporter_exporter: before 0.4.0-1.6.1
golang-github-prometheus-node_exporter: before 1.3.0-1.15.3
CPE2.3- cpe:2.3:o:suse:suse_manager_tools:12:BETA:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_openstack_cloud_crowbar:8:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_openstack_cloud_crowbar:9:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:12-SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap:12-SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:hpe_helion_openstack:8:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP3-BCL:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:12-SP4-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_openstack_cloud:8:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suseregisterinfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:supportutils-plugin-susemanager-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:supportutils-plugin-salt:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-remote-utils:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-oscap:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-koan:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-client-tools:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-client-setup:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacewalk-check:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:spacecmd:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-suseregisterinfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-oscap:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-koan:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-client-tools:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-client-setup:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-spacewalk-check:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-rhnlib:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-virtualization-host:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-virtualization-common:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-push:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-osad:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-osa-common:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg-management:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg-actions:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-mgr-cfg:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-hwdata:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-virtualization-host:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-push:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-osad:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-daemon:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-custom-info:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg-management:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg-actions:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:mgr-cfg:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:python2-uyuni-common-libs:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:prometheus-postgres_exporter:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:prometheus-blackbox_exporter-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:prometheus-blackbox_exporter:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:grafana:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:golang-github-prometheus-alertmanager:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:golang-github-qubitproducts-exporter_exporter:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:golang-github-prometheus-node_exporter:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2022/suse-su-20222134-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
