Read the docs
TI-2022-13281 Aliases CVE-2022-31248GHSA-jcvh-6rq4-c7xr

SUMA user enumeration via weak error message

Priority LOW 26CWE-204Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-204.

Summary

A Observable Response Discrepancy vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to discover valid usernames. This issue affects: SUSE Manager Server 4.1 spacewalk-java versions prior to 4.1.46-1. SUSE Manager Server 4.2 spacewalk-java versions prior to 4.2.37-1.

Why it matters now

EPSS 0.01018 63rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed SUSE Manager Server 4.1 (SUSE): 4.1.46-1SUSE Manager Server 4.2 (SUSE): 4.2.37-1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SUSESUSE Manager Server 4.1spacewalk-java to before 4.1.46-14.1.46-1Patch availableCNA
SUSESUSE Manager Server 4.2spacewalk-java to before 4.2.37-14.2.37-1Patch availableCNA
  • SUSE Manager Server 4.1 VendorSUSE Affected spacewalk-java to before 4.1.46-1 Fixed in 4.1.46-1 Patch available CNA
  • SUSE Manager Server 4.2 VendorSUSE Affected spacewalk-java to before 4.2.37-1 Fixed in 4.2.37-1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:suse:manager_server:*:*:*:*:*:*:*:*4.1 to before 4.1.46-1; 4.2 to before 4.2.37-1VulnerableSUSE
  • cpe:2.3:a:suse:manager_server:*:*:*:*:*:*:*:* Versions 4.1 to before 4.1.46-1; 4.2 to before 4.2.37-1 Vulnerable ·SUSE

Remediation

  • Fix · CNA SUSE Manager Server 4.1 (SUSE) Fixed in 4.1.46-1
  • Fix · CNA SUSE Manager Server 4.2 (SUSE) Fixed in 4.2.37-1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-31248
  2. 2026-10-03 Alias added: GHSA-jcvh-6rq4-c7xr

References

Exploit 1

  • TI-2026-23989 crypto: algif_aead - Revert to operating out-of-place KEVCVSS 3.1HIGH 7.8
  • TI-2021-02923 Out-of-bounds write in polkit KEVCVSS 3.1HIGH 7.8
  • TI-2023-13920 The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker… KEVCVSS 3.1HIGH 7.5
  • TI-2023-08821 JWT token compromise can allow malicious actions including Remote Code Execution (RCE) CVSS 4.0CRITICAL 9.4
  • TI-2022-06314 SUMA unauthenticated remote DoS via resource exhaustion CVSS 3.1HIGH 7.5
  • TI-2022-10358 In cifs-utils through 6.14, a stack-based buffer overflow when parsing the mount.cifs ip=… CVSS 3.1HIGH 7.8
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences