{"id":"CVE-2022-31253","aliases":["EUVD-2022-52830","GHSA-hxf4-pc5p-7f5c","openSUSE-SU-2024:12457-1"],"status":"published","title":"openldap2: /usr/lib/openldap/start allows ldap user/group to recursively chown arbitrary directory trees to itself","description":"A Untrusted Search Path vulnerability in openldap2 of openSUSE Factory allows local attackers with control of the ldap user or group to change ownership of arbitrary directory entries to this user/group, leading to escalation to root. This issue affects: openSUSE Factory openldap2 versions prior to 2.6.3-404.1.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00349,"percentile":0.28816,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-426"],"published":"2022-11-09T13:50:10Z","modified":"2026-06-17T04:45:13Z","products":[{"vendor":"opensuse","product":"factory"},{"vendor":"opensuse","product":"openldap2"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1202931","tags":["x_transferred","Exploit","Issue Tracking","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31253"},{"url":"https://github.com/advisories/GHSA-hxf4-pc5p-7f5c"},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-31253","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-31253","title":"openldap2: /usr/lib/openldap/start allows ldap user/group to recursively chown arbitrary directory trees to itself","description":"A Untrusted Search Path vulnerability in openldap2 of openSUSE Factory allows local attackers with control of the ldap user or group to change ownership of arbitrary directory entries to this user/group, leading to escalation to root. This issue affects: openSUSE Factory openldap2 versions prior to 2.6.3-404.1.","status":"published","published":"2022-11-09T13:50:10.848Z","modified":"2025-05-01T14:21:38.503Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-426"],"updated_at":"2026-11-02T14:34:35.279735Z"}],"euvd":[{"id":"EUVD-2022-52830","description":"A Untrusted Search Path vulnerability in openldap2 of openSUSE Factory allows local attackers with control of the ldap user or group to change ownership of arbitrary directory entries to this user/group, leading to escalation to root. This issue affects: openSUSE Factory openldap2 versions prior to 2.6.3-404.1.","status":"published","published":"2022-11-09T13:50:10Z","modified":"2025-05-01T14:21:38Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T20:51:57.509565Z"}],"ghsa":[{"id":"GHSA-hxf4-pc5p-7f5c","title":"A Untrusted Search Path vulnerability in openldap2 of openSUSE Factory allows local attackers...","description":"A Untrusted Search Path vulnerability in openldap2 of openSUSE Factory allows local attackers with control of the ldap user or group to change ownership of arbitrary directory entries to this user/group, leading to escalation to root. This issue affects: openSUSE Factory openldap2 versions prior to 2.6.3-404.1.","status":"published","published":"2022-11-09T19:02:23Z","modified":"2023-01-30T05:06:45Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-426"],"updated_at":"2026-11-02T14:47:33.82399Z"}],"nvd":[{"id":"CVE-2022-31253","description":"A Untrusted Search Path vulnerability in openldap2 of openSUSE Factory allows local attackers with control of the ldap user or group to change ownership of arbitrary directory entries to this user/group, leading to escalation to root. This issue affects: openSUSE Factory openldap2 versions prior to 2.6.3-404.1.","status":"published","published":"2022-11-09T14:15:11.897Z","modified":"2026-06-17T04:45:13.573Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-426"],"updated_at":"2026-11-02T14:07:31.914793Z"}],"osv":[{"id":"openSUSE-SU-2024:12457-1","title":"libldap-data-2.6.3-2.1 on GA media","description":"These are all security issues fixed in the libldap-data-2.6.3-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:47:44.541747Z","updated_at":"2026-11-02T16:58:35.751245Z"}]}}