CVE-2022-31253 — openldap2: /usr/lib/openldap/start allows ldap user/group to recursively chown arbitrary directory trees to itself

CVE-2022-31253

openldap2: /usr/lib/openldap/start allows ldap user/group to recursively chown arbitrary directory trees to itself PUBLISHED

Description (CNA)

A Untrusted Search Path vulnerability in openldap2 of openSUSE Factory allows local attackers with control of the ldap user or group to change ownership of arbitrary directory entries to this user/group, leading to escalation to root. This issue affects: openSUSE Factory openldap2 versions prior to 2.6.3-404.1.

Affected (CNA)

Vendor / product	Versions
openSUSE / Factory	affected openldap2 before 2.6.3-404.1

CWE

CWE-426

References

https://bugzilla.suse.com/show_bug.cgi?id=1202931

ADP enrichment

CVE

No English description supplied.

https://bugzilla.suse.com/show_bug.cgi?id=1202931

CISA-ADP

No English description supplied.

No references supplied.