CVE-2022-45153 saphanabootstrap-formula: Escalation to root for arbitrary users in hana/ha_cluster.sls

2023-02-1500:00:00

CWE-276

suse

www.cve.org

incorrect default permissions

suse linux enterprise

sap applications

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

5.1%

JSON

An Incorrect Default Permissions vulnerability in saphanabootstrap-formula of SUSE Linux Enterprise Module for SAP Applications 15-SP1, SUSE Linux Enterprise Server for SAP 12-SP5; openSUSE Leap 15.4 allows local attackers to escalate to root by manipulating the sudo configuration that is created. This issue affects: SUSE Linux Enterprise Module for SAP Applications 15-SP1 saphanabootstrap-formula versions prior to 0.13.1+git.1667812208.4db963e. SUSE Linux Enterprise Server for SAP 12-SP5 saphanabootstrap-formula versions prior to 0.13.1+git.1667812208.4db963e. openSUSE Leap 15.4 saphanabootstrap-formula versions prior to 0.13.1+git.1667812208.4db963e.

CNA Affected

[
  {
    "vendor": "SUSE",
    "product": "SUSE Linux Enterprise Module for SAP Applications 15-SP1",
    "versions": [
      {
        "version": "saphanabootstrap-formula",
        "status": "affected",
        "lessThan": "0.13.1+git.1667812208.4db963e",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "SUSE",
    "product": "SUSE Linux Enterprise Server for SAP 12-SP5",
    "versions": [
      {
        "version": "saphanabootstrap-formula",
        "status": "affected",
        "lessThan": "0.13.1+git.1667812208.4db963e",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "openSUSE",
    "product": "openSUSE Leap 15.4",
    "versions": [
      {
        "version": "saphanabootstrap-formula",
        "status": "affected",
        "lessThan": "0.13.1+git.1667812208.4db963e",
        "versionType": "custom"
      }
    ]
  }
]