Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

SUSE Manager Server: Unauthenticated Remote DoS via Disk Exhaustion

CVE-2022-21952 · published 4 years ago
Summary

A flaw in SUSE Manager Server's spacewalk-java component allows remote attackers to exhaust available disk resources, leading to a denial-of-service (DoS) situation. This affects SUSE Manager Server versions 4.1 and 4.2, and users should update to the latest version of spacewalk-java to prevent this issue.

What to do
  • Update suse suse manager server 4.1 to version 4.1.46 or later.
  • Update suse suse manager server 4.2 to version 4.2.37 or later.
Affected software
VendorProductAffected versions
suse suse manager server 4.1 < 4.1.46
suse suse manager server 4.2 < 4.2.37
suse manager_server >= 4.1, < 4.1.46
>= 4.2, < 4.2.37
cpe:2.3:a:suse:manager_server:*:*:*:*:*:*:*:*
Original advisory text
A Missing Authentication for Critical Function vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to easily exhaust available disk resources...
A Missing Authentication for Critical Function vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to easily exhaust available disk resources leading to DoS. This issue affects: SUSE Manager Server 4.1 spacewalk-java versions prior to 4.1.46. SUSE Manager Server 4.2 spacewalk-java versions prior to 4.2.37.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
1% chance of attack within 30 days
Type
CWE-306Missing Authentication for Critical Function
CWE-770Allocation of Resources Without Limits
Timeline
Published22 Jun 2022
Updated3 Nov 2026
First seen7 Jul 2026
Sources
CVE-2022-21952 · NVD
CVE-2022-21952 · MITRE
Track software like this
Free during beta