Vulnerabilities > CVE-2023-22644 - Unspecified vulnerability in Suse Manager Server

CVSS 5.5 - MEDIUM

Attack vector

LOCAL

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

local

low complexity

suse

NVD

Published: 2023-09-20

Updated: 2024-11-21

Summary

A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE.

Vulnerable Configurations

Part	Description	Count
Application	Suse Suse Manager Server 4.2 Suse Manager Server 4.2.1 Suse Manager Server 4.2.2 Suse Manager Server 4.2.3 Suse Manager Server 4.2.4 Suse Manager Server 4.2.5 Suse Manager Server 4.2.6 Suse Manager Server 4.2.7 Suse Manager Server 4.2.8 Suse Manager Server 4.2.9 Suse Manager Server 4.2.10 Suse Manager Server 4.3 Suse Manager Server 4.3.1 Suse Manager Server 4.3.2	14

References

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22644
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32188
https://github.com/neuvector/neuvector/security/advisories/GHSA-622h-h2p8-743x