CVE-2022-31256: sendmail: mail to root privilege escalation via sm-client.pre script
Published Oct 26, 2022
·Updated
A Improper Link Resolution Before File Access ('Link Following') vulnerability in a script called by the sendmail systemd service of openSUSE Factory allows local attackers to escalate from user mail to root. This issue affects: SUSE openSUSE Factory sendmail versions prior to 8.17.1-1.1.
Affected Software
1 affected component
openSUSE Factory<8.17.1-1.1
Event History
Oct 26, 2022
CVE Published
via MITRE·08:55 AM
Data Sourced
via MITRE·08:55 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2022-31256.
2
What is the title of this vulnerability?
The title of this vulnerability is 'A Improper Link Resolution Before File Access (Link Following) vulnerability in a script called by...'.
3
What is the severity of CVE-2022-31256?
The severity of CVE-2022-31256 is high (7.8).
4
How does CVE-2022-31256 affect openSUSE Factory?
CVE-2022-31256 affects openSUSE Factory sendmail versions prior to 8.17.1-1.1.
5
How can local attackers exploit CVE-2022-31256?
Local attackers can exploit CVE-2022-31256 to escalate from user mail to root.