Read the docs
TI-2022-13285 Aliases CVE-2022-31252GHSA-hr65-wxm7-w4jv

permissions: chkstat does not check for group-writable parent directories or target files in safeOpen()

Priority LOW 19CWE-863Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

A Incorrect Authorization vulnerability in chkstat of SUSE Linux Enterprise Server 12-SP5; openSUSE Leap 15.3, openSUSE Leap 15.4, openSUSE Leap Micro 5.2 did not consider group writable path components, allowing local attackers with access to a group what can write to a location included in the path to a privileged binary to influence path resolution. This issue affects: SUSE Linux Enterprise Server 12-SP5 permissions versions prior to 20170707. openSUSE Leap 15.3 permissions versions prior to 20200127. openSUSE Leap 15.4 permissions versions prior to 20201225. openSUSE Leap Micro 5.2 permissions versions prior to 20181225.

Why it matters now

EPSS 0.0015 4th percentileScored 2026-11-07
Fix Fixed SUSE Linux Enterprise Server 12-SP5 (SUSE): 20170707openSUSE Leap 15.3 (openSUSE): 20200127+2 more products

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SUSESUSE Linux Enterprise Server 12-SP5permissions to before 2017070720170707Patch availableCNA
openSUSEopenSUSE Leap 15.3permissions to before 2020012720200127Patch availableCNA
openSUSEopenSUSE Leap 15.4permissions to before 2020122520201225Patch availableCNA
openSUSEopenSUSE Leap Micro 5.2permissions to before 2018122520181225Patch availableCNA
  • SUSE Linux Enterprise Server 12-SP5 VendorSUSE Affected permissions to before 20170707 Fixed in 20170707 Patch available CNA
  • openSUSE Leap 15.3 VendoropenSUSE Affected permissions to before 20200127 Fixed in 20200127 Patch available CNA
  • openSUSE Leap 15.4 VendoropenSUSE Affected permissions to before 20201225 Fixed in 20201225 Patch available CNA
  • openSUSE Leap Micro 5.2 VendoropenSUSE Affected permissions to before 20181225 Fixed in 20181225 Patch available CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:o:opensuse:leap:15.3:*:*:*:*:*:*:*15.3VulnerableopenSUSE
cpe:2.3:o:opensuse:leap:15.4:*:*:*:*:*:*:*15.4VulnerableopenSUSE
cpe:2.3:o:opensuse:leap_micro:5.2:*:*:*:*:*:*:*5.2VulnerableopenSUSE
cpe:2.3:o:suse:linux_enterprise_server:12:sp5:*:*:*:*:*:*12 sp5VulnerableSUSE
  • cpe:2.3:o:opensuse:leap:15.3:*:*:*:*:*:*:* Versions 15.3 Vulnerable ·openSUSE
  • cpe:2.3:o:opensuse:leap:15.4:*:*:*:*:*:*:* Versions 15.4 Vulnerable ·openSUSE
  • cpe:2.3:o:opensuse:leap_micro:5.2:*:*:*:*:*:*:* Versions 5.2 Vulnerable ·openSUSE
  • cpe:2.3:o:suse:linux_enterprise_server:12:sp5:*:*:*:*:*:* Versions 12 sp5 Vulnerable ·SUSE

Remediation

  • Fix · CNA SUSE Linux Enterprise Server 12-SP5 (SUSE) Fixed in 20170707
  • Fix · CNA openSUSE Leap 15.3 (openSUSE) Fixed in 20200127
  • Fix · CNA openSUSE Leap 15.4 (openSUSE) Fixed in 20201225
  • Fix · CNA openSUSE Leap Micro 5.2 (openSUSE) Fixed in 20181225

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-31252
  2. 2026-10-03 Alias added: GHSA-hr65-wxm7-w4jv

References

Advisory 1

  • TI-2016-02888 Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77… KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-02923 Access control flaw in ProFTPD mod_copy allows arbitrary file access KEVCVSS 3.1CRITICAL 10.0
  • TI-2015-02278 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
  • TI-2013-02212 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java… KEVCVSS 3.1CRITICAL 9.8
See all 475 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences