SUSE update for SUSE Manager Client Tools
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 7 |
| CVE-ID | CVE-2023-3128 CVE-2023-6152 CVE-2024-22037 CVE-2024-45337 CVE-2024-51744 CVE-2024-6837 CVE-2024-8118 |
| CWE-ID | CWE-287 CWE-863 CWE-200 CWE-285 CWE-1059 CWE-79 CWE-284 |
| Exploitation vector | Network |
| Public exploit | Public exploit code for vulnerability #4 is available. |
| Vulnerable software |
SUSE Linux Enterprise High Performance Computing LTSS 15 Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing ESPOS 15 Operating systems & Components / Operating system SUSE Linux Enterprise Server 15 SP5 Operating systems & Components / Operating system SUSE Linux Enterprise Server 15 SP3 Operating systems & Components / Operating system SUSE Linux Enterprise Server 15 SP4 Operating systems & Components / Operating system SUSE Package Hub 15 Operating systems & Components / Operating system Basesystem Module Operating systems & Components / Operating system SUSE Linux Enterprise Real Time 15 Operating systems & Components / Operating system openSUSE Leap Operating systems & Components / Operating system SUSE Linux Enterprise Server for SAP Applications 15 Operating systems & Components / Operating system SUSE Linux Enterprise Server 15 Operating systems & Components / Operating system SUSE Linux Enterprise Desktop 15 Operating systems & Components / Operating system SUSE Linux Enterprise Micro Operating systems & Components / Operating system SUSE Manager Client Tools for SLE Micro Operating systems & Components / Operating system SUSE Manager Client Tools for SLE Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing 15 Operating systems & Components / Operating system SUSE Linux Enterprise Desktop Operating systems & Components / Operating system SUSE Linux Enterprise Server Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing Operating systems & Components / Operating system SUSE Enterprise Storage Operating systems & Components / Operating system SUSE Manager Retail Branch Server Operating systems & Components / Operating system SUSE Manager Server Operating systems & Components / Operating system SUSE Manager Proxy Operating systems & Components / Operating system SUSE Linux Enterprise Server for SAP Applications Operating systems & Components / Operating system firewalld-prometheus-config Operating systems & Components / Operating system package or component mgrctl Operating systems & Components / Operating system package or component mgrctl-debuginfo Operating systems & Components / Operating system package or component golang-github-prometheus-prometheus Operating systems & Components / Operating system package or component grafana Operating systems & Components / Operating system package or component grafana-debuginfo Operating systems & Components / Operating system package or component mgrctl-zsh-completion Operating systems & Components / Operating system package or component mgrctl-bash-completion Operating systems & Components / Operating system package or component mgrctl-lang Operating systems & Components / Operating system package or component golang-github-prometheus-promu Operating systems & Components / Operating system package or component spacecmd Operating systems & Components / Operating system package or component supportutils-plugin-susemanager-client Operating systems & Components / Operating system package or component dracut-saltboot Operating systems & Components / Operating system package or component supportutils-plugin-salt Operating systems & Components / Operating system package or component |
| Vendor | SUSE |
Security Bulletin
This security bulletin contains information about 7 vulnerabilities.
1) Improper Authentication
EUVDB-ID: #VU77652
Risk: High
CVSSv4.0: 8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2023-3128
CWE-ID:
CWE-287 - Improper Authentication
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to an error in Azure AD OAuth implementation. Grafana is validating Azure AD accounts based on the email claim. On Azure AD, the profile email field is not unique and can be easily modified. A remote attacker can modify their profile and provide the email address of an existing Grafana user, bypass authentication process and gain unauthorized access to the application.
The vulnerability affects Grafana installations with Azure AD OAuth configured for a multi-tenant app.
Update the affected package SUSE Manager Client Tools to the latest version.
Vulnerable software versionsSUSE Linux Enterprise High Performance Computing LTSS 15: SP3 - SP5
SUSE Linux Enterprise High Performance Computing ESPOS 15: SP4 - SP5
SUSE Linux Enterprise Server 15 SP5: LTSS
SUSE Linux Enterprise Server 15 SP3: LTSS
SUSE Linux Enterprise Server 15 SP4: LTSS
SUSE Package Hub 15: 15-SP6
Basesystem Module: 15-SP6
SUSE Linux Enterprise Real Time 15: SP1 - SP6
openSUSE Leap: 15.3 - 15.6
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP6
SUSE Linux Enterprise Server 15: SP1 - SP6
SUSE Linux Enterprise Desktop 15: SP1 - SP6
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Manager Client Tools for SLE Micro: 5
SUSE Manager Client Tools for SLE: 15
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
SUSE Enterprise Storage: 7.1
SUSE Manager Retail Branch Server: 4.3
SUSE Manager Server: 4.3
SUSE Manager Proxy: 4.3
SUSE Linux Enterprise Server for SAP Applications: 15
firewalld-prometheus-config: before 0.1-150000.3.59.1
mgrctl: before 0.1.28-150000.1.16.1
mgrctl-debuginfo: before 0.1.28-150000.1.16.1
golang-github-prometheus-prometheus: before 2.53.3-150000.3.59.1
grafana: before 10.4.13-150000.1.66.1
grafana-debuginfo: before 10.4.13-150000.1.66.1
mgrctl-zsh-completion: before 0.1.28-150000.1.16.1
mgrctl-bash-completion: before 0.1.28-150000.1.16.1
mgrctl-lang: before 0.1.28-150000.1.16.1
golang-github-prometheus-promu: before 0.17.0-150000.3.24.1
spacecmd: before 5.0.11-150000.3.130.1
supportutils-plugin-susemanager-client: before 5.0.4-150000.3.27.1
dracut-saltboot: before 0.1.1728559936.c16d4fb-150000.1.56.1
supportutils-plugin-salt: before 1.2.3-150000.3.16.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_ltss_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_ltss_15:SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_ltss_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_espos_15:SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_espos_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp5:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp3:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp4:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_package_hub_15:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:basesystem_module:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_real_time_15:SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:opensuse_leap:15.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_desktop_15:SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_micro:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_client_tools_for_sle_micro:5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_client_tools_for_sle:15:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15:SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_desktop:15-SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP3-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP3-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_enterprise_storage:7.1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_retail_branch_server:4.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_server:4.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_proxy:4.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:15:*:*:*:*:*:*:*
- cpe:2.3:a:suse:firewalld-prometheus-config:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:mgrctl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:mgrctl-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:golang-github-prometheus-prometheus:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:grafana:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:grafana-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:mgrctl-zsh-completion:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:mgrctl-bash-completion:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:mgrctl-lang:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:golang-github-prometheus-promu:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:spacecmd:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:supportutils-plugin-susemanager-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:dracut-saltboot:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:supportutils-plugin-salt:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2025/suse-su-20250525-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Incorrect authorization
EUVDB-ID: #VU89210
Risk: Low
CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2023-6152
CWE-ID:
CWE-863 - Incorrect Authorization
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass email verification.
The vulnerability exists due to email addresses are verified only during sign up, if "verify_email_enabled" option is set. A remote attacker can register an account and then set an arbitrary email address without verification.
Update the affected package SUSE Manager Client Tools to the latest version.
Vulnerable software versionsSUSE Linux Enterprise High Performance Computing LTSS 15: SP3 - SP5
SUSE Linux Enterprise High Performance Computing ESPOS 15: SP4 - SP5
SUSE Linux Enterprise Server 15 SP5: LTSS
SUSE Linux Enterprise Server 15 SP3: LTSS
SUSE Linux Enterprise Server 15 SP4: LTSS
SUSE Package Hub 15: 15-SP6
Basesystem Module: 15-SP6
SUSE Linux Enterprise Real Time 15: SP1 - SP6
openSUSE Leap: 15.3 - 15.6
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP6
SUSE Linux Enterprise Server 15: SP1 - SP6
SUSE Linux Enterprise Desktop 15: SP1 - SP6
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Manager Client Tools for SLE Micro: 5
SUSE Manager Client Tools for SLE: 15
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
SUSE Enterprise Storage: 7.1
SUSE Manager Retail Branch Server: 4.3
SUSE Manager Server: 4.3
SUSE Manager Proxy: 4.3
SUSE Linux Enterprise Server for SAP Applications: 15
firewalld-prometheus-config: before 0.1-150000.3.59.1
mgrctl: before 0.1.28-150000.1.16.1
mgrctl-debuginfo: before 0.1.28-150000.1.16.1
golang-github-prometheus-prometheus: before 2.53.3-150000.3.59.1
grafana: before 10.4.13-150000.1.66.1
grafana-debuginfo: before 10.4.13-150000.1.66.1
mgrctl-zsh-completion: before 0.1.28-150000.1.16.1
mgrctl-bash-completion: before 0.1.28-150000.1.16.1
mgrctl-lang: before 0.1.28-150000.1.16.1
golang-github-prometheus-promu: before 0.17.0-150000.3.24.1
spacecmd: before 5.0.11-150000.3.130.1
supportutils-plugin-susemanager-client: before 5.0.4-150000.3.27.1
dracut-saltboot: before 0.1.1728559936.c16d4fb-150000.1.56.1
supportutils-plugin-salt: before 1.2.3-150000.3.16.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_ltss_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_ltss_15:SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_ltss_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_espos_15:SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_espos_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp5:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp3:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp4:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_package_hub_15:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:basesystem_module:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_real_time_15:SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:opensuse_leap:15.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_desktop_15:SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_micro:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_client_tools_for_sle_micro:5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_client_tools_for_sle:15:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15:SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_desktop:15-SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP3-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP3-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_enterprise_storage:7.1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_retail_branch_server:4.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_server:4.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_proxy:4.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:15:*:*:*:*:*:*:*
- cpe:2.3:a:suse:firewalld-prometheus-config:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:mgrctl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:mgrctl-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:golang-github-prometheus-prometheus:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:grafana:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:grafana-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:mgrctl-zsh-completion:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:mgrctl-bash-completion:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:mgrctl-lang:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:golang-github-prometheus-promu:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:spacecmd:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:supportutils-plugin-susemanager-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:dracut-saltboot:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:supportutils-plugin-salt:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2025/suse-su-20250525-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Information disclosure
EUVDB-ID: #VU104016
Risk: Low
CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2024-22037
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to the uyuni-server-attestation systemd service uses the database_password environment variable to store password. A local user can obtain the password via systemd.
MitigationUpdate the affected package SUSE Manager Client Tools to the latest version.
Vulnerable software versionsSUSE Linux Enterprise High Performance Computing LTSS 15: SP3 - SP5
SUSE Linux Enterprise High Performance Computing ESPOS 15: SP4 - SP5
SUSE Linux Enterprise Server 15 SP5: LTSS
SUSE Linux Enterprise Server 15 SP3: LTSS
SUSE Linux Enterprise Server 15 SP4: LTSS
SUSE Package Hub 15: 15-SP6
Basesystem Module: 15-SP6
SUSE Linux Enterprise Real Time 15: SP1 - SP6
openSUSE Leap: 15.3 - 15.6
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP6
SUSE Linux Enterprise Server 15: SP1 - SP6
SUSE Linux Enterprise Desktop 15: SP1 - SP6
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Manager Client Tools for SLE Micro: 5
SUSE Manager Client Tools for SLE: 15
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
SUSE Enterprise Storage: 7.1
SUSE Manager Retail Branch Server: 4.3
SUSE Manager Server: 4.3
SUSE Manager Proxy: 4.3
SUSE Linux Enterprise Server for SAP Applications: 15
firewalld-prometheus-config: before 0.1-150000.3.59.1
mgrctl: before 0.1.28-150000.1.16.1
mgrctl-debuginfo: before 0.1.28-150000.1.16.1
golang-github-prometheus-prometheus: before 2.53.3-150000.3.59.1
grafana: before 10.4.13-150000.1.66.1
grafana-debuginfo: before 10.4.13-150000.1.66.1
mgrctl-zsh-completion: before 0.1.28-150000.1.16.1
mgrctl-bash-completion: before 0.1.28-150000.1.16.1
mgrctl-lang: before 0.1.28-150000.1.16.1
golang-github-prometheus-promu: before 0.17.0-150000.3.24.1
spacecmd: before 5.0.11-150000.3.130.1
supportutils-plugin-susemanager-client: before 5.0.4-150000.3.27.1
dracut-saltboot: before 0.1.1728559936.c16d4fb-150000.1.56.1
supportutils-plugin-salt: before 1.2.3-150000.3.16.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_ltss_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_ltss_15:SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_ltss_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_espos_15:SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_espos_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp5:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp3:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp4:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_package_hub_15:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:basesystem_module:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_real_time_15:SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:opensuse_leap:15.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_desktop_15:SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_micro:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_client_tools_for_sle_micro:5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_client_tools_for_sle:15:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15:SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_desktop:15-SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP3-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP3-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_enterprise_storage:7.1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_retail_branch_server:4.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_server:4.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_proxy:4.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:15:*:*:*:*:*:*:*
- cpe:2.3:a:suse:firewalld-prometheus-config:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:mgrctl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:mgrctl-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:golang-github-prometheus-prometheus:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:grafana:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:grafana-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:mgrctl-zsh-completion:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:mgrctl-bash-completion:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:mgrctl-lang:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:golang-github-prometheus-promu:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:spacecmd:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:supportutils-plugin-susemanager-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:dracut-saltboot:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:supportutils-plugin-salt:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2025/suse-su-20250525-1/
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Improper authorization
EUVDB-ID: #VU101777
Risk: Medium
CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/U:Green]
CVE-ID: CVE-2024-45337
CWE-ID:
CWE-285 - Improper Authorization
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to gain unauthorized access to the application.
The vulnerability exists due to improper authorization caused by improper usage of the ServerConfig.PublicKeyCallback callback. A remote attacker can bypass authorization in certain cases and gain access to the application.
Update the affected package SUSE Manager Client Tools to the latest version.
Vulnerable software versionsSUSE Linux Enterprise High Performance Computing LTSS 15: SP3 - SP5
SUSE Linux Enterprise High Performance Computing ESPOS 15: SP4 - SP5
SUSE Linux Enterprise Server 15 SP5: LTSS
SUSE Linux Enterprise Server 15 SP3: LTSS
SUSE Linux Enterprise Server 15 SP4: LTSS
SUSE Package Hub 15: 15-SP6
Basesystem Module: 15-SP6
SUSE Linux Enterprise Real Time 15: SP1 - SP6
openSUSE Leap: 15.3 - 15.6
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP6
SUSE Linux Enterprise Server 15: SP1 - SP6
SUSE Linux Enterprise Desktop 15: SP1 - SP6
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Manager Client Tools for SLE Micro: 5
SUSE Manager Client Tools for SLE: 15
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
SUSE Enterprise Storage: 7.1
SUSE Manager Retail Branch Server: 4.3
SUSE Manager Server: 4.3
SUSE Manager Proxy: 4.3
SUSE Linux Enterprise Server for SAP Applications: 15
firewalld-prometheus-config: before 0.1-150000.3.59.1
mgrctl: before 0.1.28-150000.1.16.1
mgrctl-debuginfo: before 0.1.28-150000.1.16.1
golang-github-prometheus-prometheus: before 2.53.3-150000.3.59.1
grafana: before 10.4.13-150000.1.66.1
grafana-debuginfo: before 10.4.13-150000.1.66.1
mgrctl-zsh-completion: before 0.1.28-150000.1.16.1
mgrctl-bash-completion: before 0.1.28-150000.1.16.1
mgrctl-lang: before 0.1.28-150000.1.16.1
golang-github-prometheus-promu: before 0.17.0-150000.3.24.1
spacecmd: before 5.0.11-150000.3.130.1
supportutils-plugin-susemanager-client: before 5.0.4-150000.3.27.1
dracut-saltboot: before 0.1.1728559936.c16d4fb-150000.1.56.1
supportutils-plugin-salt: before 1.2.3-150000.3.16.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_ltss_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_ltss_15:SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_ltss_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_espos_15:SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_espos_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp5:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp3:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp4:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_package_hub_15:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:basesystem_module:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_real_time_15:SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:opensuse_leap:15.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_desktop_15:SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_micro:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_client_tools_for_sle_micro:5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_client_tools_for_sle:15:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15:SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_desktop:15-SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP3-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP3-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_enterprise_storage:7.1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_retail_branch_server:4.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_server:4.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_proxy:4.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:15:*:*:*:*:*:*:*
- cpe:2.3:a:suse:firewalld-prometheus-config:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:mgrctl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:mgrctl-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:golang-github-prometheus-prometheus:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:grafana:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:grafana-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:mgrctl-zsh-completion:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:mgrctl-bash-completion:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:mgrctl-lang:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:golang-github-prometheus-promu:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:spacecmd:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:supportutils-plugin-susemanager-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:dracut-saltboot:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:supportutils-plugin-salt:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2025/suse-su-20250525-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
5) Insufficient technical documentation
EUVDB-ID: #VU101894
Risk: Low
CVSSv4.0: 0.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2024-51744
CWE-ID:
CWE-1059 - Insufficient Technical Documentation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due due to unclear documentation of the error behavior in "ParseWithClaims". A remote attacker can trick the victim into accepting invalid tokens, which can lead to information disclosure.
Update the affected package SUSE Manager Client Tools to the latest version.
Vulnerable software versionsSUSE Linux Enterprise High Performance Computing LTSS 15: SP3 - SP5
SUSE Linux Enterprise High Performance Computing ESPOS 15: SP4 - SP5
SUSE Linux Enterprise Server 15 SP5: LTSS
SUSE Linux Enterprise Server 15 SP3: LTSS
SUSE Linux Enterprise Server 15 SP4: LTSS
SUSE Package Hub 15: 15-SP6
Basesystem Module: 15-SP6
SUSE Linux Enterprise Real Time 15: SP1 - SP6
openSUSE Leap: 15.3 - 15.6
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP6
SUSE Linux Enterprise Server 15: SP1 - SP6
SUSE Linux Enterprise Desktop 15: SP1 - SP6
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Manager Client Tools for SLE Micro: 5
SUSE Manager Client Tools for SLE: 15
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
SUSE Enterprise Storage: 7.1
SUSE Manager Retail Branch Server: 4.3
SUSE Manager Server: 4.3
SUSE Manager Proxy: 4.3
SUSE Linux Enterprise Server for SAP Applications: 15
firewalld-prometheus-config: before 0.1-150000.3.59.1
mgrctl: before 0.1.28-150000.1.16.1
mgrctl-debuginfo: before 0.1.28-150000.1.16.1
golang-github-prometheus-prometheus: before 2.53.3-150000.3.59.1
grafana: before 10.4.13-150000.1.66.1
grafana-debuginfo: before 10.4.13-150000.1.66.1
mgrctl-zsh-completion: before 0.1.28-150000.1.16.1
mgrctl-bash-completion: before 0.1.28-150000.1.16.1
mgrctl-lang: before 0.1.28-150000.1.16.1
golang-github-prometheus-promu: before 0.17.0-150000.3.24.1
spacecmd: before 5.0.11-150000.3.130.1
supportutils-plugin-susemanager-client: before 5.0.4-150000.3.27.1
dracut-saltboot: before 0.1.1728559936.c16d4fb-150000.1.56.1
supportutils-plugin-salt: before 1.2.3-150000.3.16.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_ltss_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_ltss_15:SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_ltss_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_espos_15:SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_espos_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp5:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp3:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp4:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_package_hub_15:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:basesystem_module:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_real_time_15:SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:opensuse_leap:15.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_desktop_15:SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_micro:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_client_tools_for_sle_micro:5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_client_tools_for_sle:15:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15:SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_desktop:15-SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP3-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP3-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_enterprise_storage:7.1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_retail_branch_server:4.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_server:4.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_proxy:4.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:15:*:*:*:*:*:*:*
- cpe:2.3:a:suse:firewalld-prometheus-config:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:mgrctl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:mgrctl-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:golang-github-prometheus-prometheus:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:grafana:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:grafana-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:mgrctl-zsh-completion:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:mgrctl-bash-completion:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:mgrctl-lang:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:golang-github-prometheus-promu:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:spacecmd:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:supportutils-plugin-susemanager-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:dracut-saltboot:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:supportutils-plugin-salt:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2025/suse-su-20250525-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
6) Cross-site scripting
EUVDB-ID: #VU96048
Risk: Medium
CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Green]
CVE-ID: CVE-2024-6837
CWE-ID:
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exploit availability: No
DescriptionThe disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in the "/swagger" endpoint. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
MitigationUpdate the affected package SUSE Manager Client Tools to the latest version.
Vulnerable software versionsSUSE Linux Enterprise High Performance Computing LTSS 15: SP3 - SP5
SUSE Linux Enterprise High Performance Computing ESPOS 15: SP4 - SP5
SUSE Linux Enterprise Server 15 SP5: LTSS
SUSE Linux Enterprise Server 15 SP3: LTSS
SUSE Linux Enterprise Server 15 SP4: LTSS
SUSE Package Hub 15: 15-SP6
Basesystem Module: 15-SP6
SUSE Linux Enterprise Real Time 15: SP1 - SP6
openSUSE Leap: 15.3 - 15.6
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP6
SUSE Linux Enterprise Server 15: SP1 - SP6
SUSE Linux Enterprise Desktop 15: SP1 - SP6
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Manager Client Tools for SLE Micro: 5
SUSE Manager Client Tools for SLE: 15
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
SUSE Enterprise Storage: 7.1
SUSE Manager Retail Branch Server: 4.3
SUSE Manager Server: 4.3
SUSE Manager Proxy: 4.3
SUSE Linux Enterprise Server for SAP Applications: 15
firewalld-prometheus-config: before 0.1-150000.3.59.1
mgrctl: before 0.1.28-150000.1.16.1
mgrctl-debuginfo: before 0.1.28-150000.1.16.1
golang-github-prometheus-prometheus: before 2.53.3-150000.3.59.1
grafana: before 10.4.13-150000.1.66.1
grafana-debuginfo: before 10.4.13-150000.1.66.1
mgrctl-zsh-completion: before 0.1.28-150000.1.16.1
mgrctl-bash-completion: before 0.1.28-150000.1.16.1
mgrctl-lang: before 0.1.28-150000.1.16.1
golang-github-prometheus-promu: before 0.17.0-150000.3.24.1
spacecmd: before 5.0.11-150000.3.130.1
supportutils-plugin-susemanager-client: before 5.0.4-150000.3.27.1
dracut-saltboot: before 0.1.1728559936.c16d4fb-150000.1.56.1
supportutils-plugin-salt: before 1.2.3-150000.3.16.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_ltss_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_ltss_15:SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_ltss_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_espos_15:SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_espos_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp5:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp3:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp4:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_package_hub_15:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:basesystem_module:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_real_time_15:SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:opensuse_leap:15.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_desktop_15:SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_micro:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_client_tools_for_sle_micro:5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_client_tools_for_sle:15:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15:SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_desktop:15-SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP3-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP3-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_enterprise_storage:7.1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_retail_branch_server:4.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_server:4.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_proxy:4.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:15:*:*:*:*:*:*:*
- cpe:2.3:a:suse:firewalld-prometheus-config:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:mgrctl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:mgrctl-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:golang-github-prometheus-prometheus:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:grafana:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:grafana-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:mgrctl-zsh-completion:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:mgrctl-bash-completion:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:mgrctl-lang:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:golang-github-prometheus-promu:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:spacecmd:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:supportutils-plugin-susemanager-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:dracut-saltboot:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:supportutils-plugin-salt:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2025/suse-su-20250525-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
7) Improper access control
EUVDB-ID: #VU99259
Risk: Low
CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2024-8118
CWE-ID:
CWE-284 - Improper Access Control
Exploit availability: No
DescriptionThe vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to wrong permission is applied to the alert rule write API endpoint. A remote user with permission to write external alert instances can also write alert rules.
Update the affected package SUSE Manager Client Tools to the latest version.
Vulnerable software versionsSUSE Linux Enterprise High Performance Computing LTSS 15: SP3 - SP5
SUSE Linux Enterprise High Performance Computing ESPOS 15: SP4 - SP5
SUSE Linux Enterprise Server 15 SP5: LTSS
SUSE Linux Enterprise Server 15 SP3: LTSS
SUSE Linux Enterprise Server 15 SP4: LTSS
SUSE Package Hub 15: 15-SP6
Basesystem Module: 15-SP6
SUSE Linux Enterprise Real Time 15: SP1 - SP6
openSUSE Leap: 15.3 - 15.6
SUSE Linux Enterprise Server for SAP Applications 15: SP1 - SP6
SUSE Linux Enterprise Server 15: SP1 - SP6
SUSE Linux Enterprise Desktop 15: SP1 - SP6
SUSE Linux Enterprise Micro: 5.0 - 5.5
SUSE Manager Client Tools for SLE Micro: 5
SUSE Manager Client Tools for SLE: 15
SUSE Linux Enterprise High Performance Computing 15: SP1 - SP5
SUSE Linux Enterprise Desktop: 15-SP1
SUSE Linux Enterprise Server: 15-SP3-LTSS
SUSE Linux Enterprise High Performance Computing: 15-SP3-LTSS
SUSE Enterprise Storage: 7.1
SUSE Manager Retail Branch Server: 4.3
SUSE Manager Server: 4.3
SUSE Manager Proxy: 4.3
SUSE Linux Enterprise Server for SAP Applications: 15
firewalld-prometheus-config: before 0.1-150000.3.59.1
mgrctl: before 0.1.28-150000.1.16.1
mgrctl-debuginfo: before 0.1.28-150000.1.16.1
golang-github-prometheus-prometheus: before 2.53.3-150000.3.59.1
grafana: before 10.4.13-150000.1.66.1
grafana-debuginfo: before 10.4.13-150000.1.66.1
mgrctl-zsh-completion: before 0.1.28-150000.1.16.1
mgrctl-bash-completion: before 0.1.28-150000.1.16.1
mgrctl-lang: before 0.1.28-150000.1.16.1
golang-github-prometheus-promu: before 0.17.0-150000.3.24.1
spacecmd: before 5.0.11-150000.3.130.1
supportutils-plugin-susemanager-client: before 5.0.4-150000.3.27.1
dracut-saltboot: before 0.1.1728559936.c16d4fb-150000.1.56.1
supportutils-plugin-salt: before 1.2.3-150000.3.16.1
CPE2.3- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_ltss_15:SP3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_ltss_15:SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_ltss_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_espos_15:SP4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_espos_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp5:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp3:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15_sp4:LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_package_hub_15:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:basesystem_module:15-SP6:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_real_time_15:SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:opensuse_leap:15.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_desktop_15:SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_micro:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_client_tools_for_sle_micro:5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_client_tools_for_sle:15:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15:SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_desktop:15-SP1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server:15-SP3-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing:15-SP3-LTSS:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_enterprise_storage:7.1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_retail_branch_server:4.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_server:4.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_manager_proxy:4.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications:15:*:*:*:*:*:*:*
- cpe:2.3:a:suse:firewalld-prometheus-config:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:mgrctl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:mgrctl-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:golang-github-prometheus-prometheus:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:grafana:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:grafana-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:mgrctl-zsh-completion:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:mgrctl-bash-completion:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:mgrctl-lang:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:golang-github-prometheus-promu:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:spacecmd:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:supportutils-plugin-susemanager-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:dracut-saltboot:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:supportutils-plugin-salt:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2025/suse-su-20250525-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
