CVE-2022-45155 obs-service-go_modules: arbitrary directory delete
Attackers can delete arbitrary files and directories on the victim's system by influencing service calls in the openSUSE build service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-45155?
CVE-2022-45155 is a medium-severity path traversal vulnerability in openSUSE Factory, published on 15 Mar 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
An Improper Handling of Exceptional Conditions vulnerability in obs-service-go_modules of openSUSE Factory allows attackers that can influence the call to the service to delete files and directories on the system of the victim. This issue affects: SUSE openSUSE Factory obs-service-go_modules versions prior to 0.6.1.
Weakness: CWE-755
Which versions are affected by CVE-2022-45155?
It affects 1 product.
Linux distribution packages (1)
obs-service-go_modules openSUSE:Tumbleweed | All versions | 0.6.1-1.1 |
Products include Suse Opensuse Factory.
How do I fix CVE-2022-45155?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2022-45155 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-45155 exists.
Sources
Also known as GHSA-3c33-2j43-9jqp, openSUSE-SU-2024:12740-1.