{"id":"CVE-2022-31256","aliases":["EUVD-2022-52833","GHSA-cfgc-fgg8-p3qf","SUSE-SU-2022:3898-1","SUSE-SU-2022:3899-1"],"status":"published","title":"sendmail: mail to root privilege escalation via sm-client.pre script","description":"A Improper Link Resolution Before File Access ('Link Following') vulnerability in a script called by the sendmail systemd service of openSUSE Factory allows local attackers to escalate from user mail to root. This issue affects: SUSE openSUSE Factory sendmail versions prior to 8.17.1-1.1.","severity":{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00251,"percentile":0.16634,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-59"],"published":"2022-10-26T08:55:09Z","modified":"2026-06-17T04:45:14Z","fixes":[{"ecosystem":"SUSE:Linux Enterprise Module for Legacy 12","package":"sendmail","fixed_in":["8.14.9-4.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"sendmail","fixed_in":["8.15.2-150000.8.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"sendmail","fixed_in":["8.15.2-150000.8.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"sendmail","fixed_in":["8.15.2-150000.8.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"sendmail","fixed_in":["8.15.2-150000.8.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"sendmail","fixed_in":["8.15.2-150000.8.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"sendmail","fixed_in":["8.15.2-150000.8.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"sendmail","fixed_in":["8.15.2-150000.8.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"sendmail","fixed_in":["8.15.2-150000.8.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"sendmail","fixed_in":["8.15.2-150000.8.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"sendmail","fixed_in":["8.15.2-150000.8.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"sendmail","fixed_in":["8.15.2-150000.8.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"sendmail","fixed_in":["8.15.2-150000.8.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"sendmail","fixed_in":["8.15.2-150000.8.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"sendmail","fixed_in":["8.15.2-150000.8.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"sendmail","fixed_in":["8.15.2-150000.8.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"sendmail","fixed_in":["8.15.2-150000.8.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"sendmail","fixed_in":["8.15.2-150000.8.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"sendmail","fixed_in":["8.15.2-150000.8.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.1","package":"sendmail","fixed_in":["8.15.2-150000.8.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"sendmail","fixed_in":["8.15.2-150000.8.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.1","package":"sendmail","fixed_in":["8.15.2-150000.8.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 6","package":"sendmail","fixed_in":["8.15.2-150000.8.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7","package":"sendmail","fixed_in":["8.15.2-150000.8.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"sendmail","fixed_in":["8.15.2-150000.8.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"sendmail","fixed_in":["8.15.2-150000.8.9.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 12","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.9-4.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.15.2-150000.8.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.15.2-150000.8.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.15.2-150000.8.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.15.2-150000.8.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.15.2-150000.8.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.15.2-150000.8.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.15.2-150000.8.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.15.2-150000.8.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.15.2-150000.8.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.15.2-150000.8.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.15.2-150000.8.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.15.2-150000.8.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.15.2-150000.8.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.15.2-150000.8.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.15.2-150000.8.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.15.2-150000.8.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.15.2-150000.8.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.15.2-150000.8.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.15.2-150000.8.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.15.2-150000.8.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.15.2-150000.8.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.15.2-150000.8.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.15.2-150000.8.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.15.2-150000.8.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.15.2-150000.8.9.1"}]}]}],"products":[{"vendor":"opensuse","product":"factory"},{"vendor":"suse","product":"opensuse factory"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1204696","tags":["x_transferred","Issue Tracking","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31256"},{"url":"https://github.com/advisories/GHSA-cfgc-fgg8-p3qf"},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223898-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1202937","tags":["report"]},{"url":"https://bugzilla.suse.com/1204696","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-31256","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223899-1/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-31256","title":"sendmail: mail to root privilege escalation via sm-client.pre script","description":"A Improper Link Resolution Before File Access ('Link Following') vulnerability in a script called by the sendmail systemd service of openSUSE Factory allows local attackers to escalate from user mail to root. This issue affects: SUSE openSUSE Factory sendmail versions prior to 8.17.1-1.1.","status":"published","published":"2022-10-26T08:55:09.458Z","modified":"2025-05-09T19:11:55.65Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:34:35.279735Z"}],"euvd":[{"id":"EUVD-2022-52833","description":"A Improper Link Resolution Before File Access ('Link Following') vulnerability in a script called by the sendmail systemd service of openSUSE Factory allows local attackers to escalate from user mail to root. This issue affects: SUSE openSUSE Factory sendmail versions prior to 8.17.1-1.1.","status":"published","published":"2022-10-26T08:55:09Z","modified":"2025-05-09T19:11:55Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T20:32:50.201515Z"}],"ghsa":[{"id":"GHSA-cfgc-fgg8-p3qf","title":"A Improper Link Resolution Before File Access ('Link Following') vulnerability in a script called...","description":"A Improper Link Resolution Before File Access ('Link Following') vulnerability in a script called by the sendmail systemd service of openSUSE Factory allows local attackers to escalate from user mail to root. This issue affects: SUSE openSUSE Factory sendmail versions prior to 8.17.1-1.1.","status":"published","published":"2022-10-26T12:00:28Z","modified":"2023-01-30T05:03:01Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:46:45.069338Z"}],"nvd":[{"id":"CVE-2022-31256","description":"A Improper Link Resolution Before File Access ('Link Following') vulnerability in a script called by the sendmail systemd service of openSUSE Factory allows local attackers to escalate from user mail to root. This issue affects: SUSE openSUSE Factory sendmail versions prior to 8.17.1-1.1.","status":"published","published":"2022-10-26T09:15:15.613Z","modified":"2026-06-17T04:45:14.233Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:07:31.127985Z"}],"osv":[{"id":"SUSE-SU-2022:3898-1","title":"Security update for sendmail","description":"This update for sendmail fixes the following issues:\n\n  - CVE-2022-31256: Fixed mail to root privilege escalation via sm-client.pre script (bsc#1204696, bsc#1202937).\n","status":"published","published":"2022-11-08T09:41:15Z","modified":"2026-02-04T02:56:15.793781Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3899-1","title":"Security update for sendmail","description":"This update for sendmail fixes the following issues:\n\n  - CVE-2022-31256: Fixed mail to root privilege escalation via sm-client.pre script (bsc#1204696, bsc#1202937).\n","status":"published","published":"2022-11-08T09:44:24Z","modified":"2026-02-04T04:32:37.891296Z","updated_at":"2026-11-02T15:53:51.440565Z"}]}}