CVE-2022-2031

A flaw was found in Samba. The security vulnerability occurs when KDC and the kpasswd service share a single account and set of keys, allowing them to decrypt each other's tickets. A user who has been requested to change their password, can exploit this flaw to obtain and use tickets to other services.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://security.gentoo.org/glsa/202309-06
https://www.samba.org/samba/security/CVE-2022-2031.html	Vendor Advisory
https://security.gentoo.org/glsa/202309-06
https://www.samba.org/samba/security/CVE-2022-2031.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:samba:samba::::::::
	cpe:2.3:a:samba:samba::::::::
	cpe:2.3:a:samba:samba::::::::

History

21 Nov 2024, 07:00

Type	Values Removed	Values Added
References	~~() https://security.gentoo.org/glsa/202309-06 -~~	() https://security.gentoo.org/glsa/202309-06 -
References	~~() https://www.samba.org/samba/security/CVE-2022-2031.html - Vendor Advisory~~	() https://www.samba.org/samba/security/CVE-2022-2031.html - Vendor Advisory

17 Sep 2023, 09:15

Type	Values Removed	Values Added
References		(GENTOO) https://security.gentoo.org/glsa/202309-06 -

Information

Published : 2022-08-25 18:15

Updated : 2024-11-21 07:00

NVD link : CVE-2022-2031

Mitre link : CVE-2022-2031

CVE.ORG link : CVE-2022-2031

JSON object : View

Products Affected

samba

samba

CWE

CWE-288

Authentication Bypass Using an Alternate Path or Channel

CWE-287

Improper Authentication

{"id": "CVE-2022-2031", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2022-08-25T18:15:09.837", "references": [{"url": "https://security.gentoo.org/glsa/202309-06", "source": "secalert@redhat.com"}, {"url": "https://www.samba.org/samba/security/CVE-2022-2031.html", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://security.gentoo.org/glsa/202309-06", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.samba.org/samba/security/CVE-2022-2031.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-288"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in Samba. The security vulnerability occurs when KDC and the kpasswd service share a single account and set of keys, allowing them to decrypt each other's tickets. A user who has been requested to change their password, can exploit this flaw to obtain and use tickets to other services."}, {"lang": "es", "value": "Se ha encontrado un fallo en Samba. Una vulnerabilidad de seguridad es producida cuando el KDC y el servicio kpasswd comparten una misma cuenta y un mismo conjunto de claves, lo que les permite descifrar los tickets del otro. Un usuario al que le haya sido pedido que cambie su contrase\u00f1a, puede explotar este fallo para obtener y usar tickets de otros servicios."}], "lastModified": "2024-11-21T07:00:12.323", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4C2499D3-277A-4B0F-AD27-4506D02829DE", "versionEndExcluding": "4.14.14"}, {"criteria": "cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1B0E54A3-23C1-497D-864D-EDF15D85FB81", "versionEndExcluding": "4.15.9", "versionStartIncluding": "4.15.0"}, {"criteria": "cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8479455F-FFCD-46F1-B0E3-EBC082F89C16", "versionEndExcluding": "4.16.4", "versionStartIncluding": "4.16.0"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}