Vulnerability record · CVE-2022-31248 · published 22 June 2022

CVE-2022-31248: Suse manager server vulnerability

Suse · Manager Server

A Observable Response Discrepancy vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to discover valid usernames. This issue affects: SUSE Manager Server 4.1 spacewalk-java versions prior to 4.1.46-1. SUSE Manager Server 4.2 spacewalk-java versions prior to 4.2.37-1.

5.3 CVSS 3.1 Medium EPSS 1.0% · top 38.1% CWE-204 · CWE-204

5.3CVSS 3.1 base score, v2 5.0

1.0%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

2References, 2 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Manager Server Suse

References

Link	Tags
https://bugzilla.suse.com/show_bug.cgi?id=1199629	ExploitIssue TrackingThird Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1199629	ExploitIssue TrackingThird Party Advisory

Track CVE-2022-31248 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2026-31431Linux kernel algif_aead in-place crypto operation flawThe Linux kernel's algif_aead AF_ALG AEAD interface operated in-place on buffers that come from different mappings, a flaw the fix resolves by revert…KEVEPSS 3.4%analysed22 Apr 2026 7.8CVE-2021-4034polkit pkexec argument handling flaw allows local root escalationpkexec, the setuid polkit utility for running commands as privileged users, mishandles the calling parameter count and ends up treating environment v…KEVEPSS 94%analysed28 Jan 2022 7.5CVE-2023-29552Service Location Protocol unauthenticated service registration enables DoS amplificationThe Service Location Protocol (SLP, RFC 2608) permits an unauthenticated, remote attacker to register arbitrary services. This allows spoofed UDP tra…KEVEPSS 64%analysed25 Apr 2023 9.4CVE-2023-22644Suse manager server vulnerabilityA user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perf…EPSS 0.46%20 Sep 2023 7.8CVE-2022-27239Samba cifs-utils out-of-bounds write vulnerabilityIn cifs-utils through 6.14, a stack-based buffer overflow when parsing the mount.cifs ip= command-line argument could lead to local attackers gaining…EPSS 0.58%27 Apr 2022 7.5CVE-2022-21952Suse manager server missing authentication for critical function vulnerabilityA Missing Authentication for Critical Function vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote atta…EPSS 1.5%22 Jun 2022 5.4CVE-2022-43754Suse manager server cross-site scripting vulnerabilityAn Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in spacewalk/Uyuni of SUSE Linux Enterprise Mod…EPSS 0.41%10 Nov 2022 4.3CVE-2022-43753Suse manager server path traversal vulnerabilityA Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in spacewalk/Uyuni of SUSE Linux Enterprise Module for…EPSS 0.77%10 Nov 2022

Source: NIST National Vulnerability Database (record CVE-2022-31248), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.