CVE-2022-2031

State: Published
Severity: Not scored
Published: Aug 25, 2022
Updated: Aug 3, 2024
Reserved: Jun 8, 2022

Description

A flaw was found in Samba. The security vulnerability occurs when KDC and the kpasswd service share a single account and set of keys, allowing them to decrypt each other's tickets. A user who has been requested to change their password, can exploit this flaw to obtain and use tickets to other services.

Scores

The record has no CVSS score.

Weaknesses

CWE-288

Affected Products

Product	Versions
samban/a	Versions prior to samba 4.16.4, samba 4.15.9, samba 4.14.14Affected

References

https://www.samba.org/samba/security/CVE-2022-2031.html
GLSA-202309-06vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.