CVE-2024-22037

Database password leaked by systemd uyuni-server-attestation service

CVSS 5.7 MEDIUMEPSS 0.2%CWE-497

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 5.7EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

28 Nov 2024Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

The uyuni-server-attestation systemd service needs a database_password environment variable. This file has 640 permission, and cannot be shown users, but the environment is still exposed by systemd to non-privileged users.

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L

Affected products

SUSE · SUSE Manager Server 5.0

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2024-22037