Lucene search

RedhatCVELIST:CVE-2022-32744

HistoryAug 25, 2022 - 12:00 a.m.

CVE-2022-32744

2022-08-2500:00:00

CWE-290

redhat

www.cve.org

samba

kdc

kpasswd

AI Score

8.7

Confidence

High

EPSS

0.001

Percentile

42.9%

JSON

A flaw was found in Samba. The KDC accepts kpasswd requests encrypted with any key known to it. By encrypting forged kpasswd requests with its own key, a user can change other users’ passwords, enabling full domain takeover.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "samba",
    "versions": [
      {
        "version": "Versions prior to samba 4.16.4, samba 4.15.9, samba 4.14.14",
        "status": "affected"
      }
    ]
  }
]

References

security.gentoo.org/glsa/202309-06

www.samba.org/samba/security/CVE-2022-32744.html