Information Exposure Through an Error Message in Uyuni SUSE Manager - CVE-2022-31248

Vulnerability identifier: #VU64572

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-31248

CWE-ID: CWE-209

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to enumerate email addresses of registered users.

The vulnerability exists due to the application in /rhn/help/ForgotCredentials.do exposes information about pretense of an email address of the registered user within the application. A remote non-authenticated attacker can enumerate email addresses of application users.

Uyuni SUSE Manager
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Module for SUSE Manager Server
SUSE Manager Proxy
image-sync-formula
inter-server-sync
inter-server-sync-debuginfo
prometheus-formula
golang-github-QubitProducts-exporter_exporter
jose4j
golang-github-lusitaniae-apache_exporter-debuginfo
golang-github-lusitaniae-apache_exporter
prometheus-exporters-formula
salt-netapi-client
subscription-matcher
virtual-host-gatherer-libcloud
virtual-host-gatherer-VMware
virtual-host-gatherer-Nutanix
virtual-host-gatherer-Kubernetes
virtual-host-gatherer
susemanager-retail-tools
python3-susemanager-retail
xmlpull-api
jakarta-commons-validator
supportutils-plugin-salt
apache-commons-csv
golang-github-prometheus-node_exporter
smdba
mvel2
apache-commons-math3
python3-urlgrabber
spacewalk-setup
release-notes-susemanager-proxy
release-notes-susemanager
spacecmd
spacewalk-utils
spacewalk-utils-extras
susemanager-schema
spacewalk-backend-config-files-tool
spacewalk-backend-xmlrpc
spacewalk-backend-xml-export-libs
spacewalk-backend-tools
spacewalk-backend-sql-postgresql
spacewalk-backend-sql
spacewalk-backend-server
spacewalk-backend-package-push-server
spacewalk-backend-iss-export
spacewalk-backend-iss
spacewalk-backend-config-files-common
spacewalk-backend-config-files
spacewalk-backend-applet
spacewalk-backend-app
spacewalk-backend
susemanager-web-libs
spacewalk-base-minimal
spacewalk-base-minimal-config
spacewalk-html
spacewalk-base
susemanager-tools
susemanager
susemanager-sls
uyuni-config-modules
spacewalk-java
spacewalk-java-config
spacewalk-java-lib
spacewalk-java-postgresql
spacewalk-taskomatic
patterns-suma_server
patterns-suma_retail
susemanager-docs_en
susemanager-docs_en-pdf
susemanager-doc-indexes
spacewalk-search
spacewalk-admin
susemanager-sync-data
spacewalk-branding
spacewalk-certs-tools
python3-spacewalk-certs-tools
spacewalk-client-tools
python3-spacewalk-client-tools
spacewalk-postgresql
spacewalk-common
python3-uyuni-common-libs
spacewalk-config
susemanager-schema-utility
woodstox
reprepro
reprepro-debugsource
reprepro-debuginfo
drools
kie-api
optaplanner
susemanager-build-keys-web
susemanager-build-keys
postgresql-jdbc
py27-compat-salt

Install updates from vendor's website.

Uyuni SUSE Manager - update to 4.1.36-1
image-sync-formula - update to 0.1.1658330139.861779d-150400.3.3.1
inter-server-sync - addressed in versions 0.2.2-150300.8.17.1, 0.2.3-150400.3.3.1
inter-server-sync-debuginfo - addressed in versions 0.2.2-150300.8.17.1, 0.2.3-150400.3.3.1
prometheus-formula - addressed in versions 0.3.7-150200.3.21.2, 0.6.2-150300.3.14.1
golang-github-QubitProducts-exporter_exporter - update to 0.4.0-150200.6.12.2
jose4j - addressed in versions 0.5.1-150300.3.3.2, 0.5.1-150400.3.3.1
golang-github-lusitaniae-apache_exporter-debuginfo - update to 0.7.0-150200.2.6.2
golang-github-lusitaniae-apache_exporter - update to 0.7.0-150200.2.6.2
prometheus-exporters-formula - update to 0.9.5-150200.3.31.2
salt-netapi-client - addressed in versions 0.19.0-150300.3.6.1, 0.20.0-150400.3.3.5
subscription-matcher - addressed in versions 0.28-150200.3.15.2, 0.29-150300.6.9.2, 0.29-150400.3.3.1
virtual-host-gatherer-libcloud - addressed in versions 1.0.23-150300.3.3.1, 1.0.23-150300.3.6.2, 1.0.23-150400.3.3.1
virtual-host-gatherer-VMware - addressed in versions 1.0.23-150300.3.3.1, 1.0.23-150300.3.6.2, 1.0.23-150400.3.3.1
virtual-host-gatherer-Nutanix - addressed in versions 1.0.23-150300.3.3.1, 1.0.23-150300.3.6.2, 1.0.23-150400.3.3.1
virtual-host-gatherer-Kubernetes - addressed in versions 1.0.23-150300.3.3.1, 1.0.23-150300.3.6.2, 1.0.23-150400.3.3.1
virtual-host-gatherer - addressed in versions 1.0.23-150300.3.3.1, 1.0.23-150300.3.6.2, 1.0.23-150400.3.3.1
susemanager-retail-tools - addressed in versions 1.0.1653987003.92d4870-150300.3.3.2, 1.0.1658330139.861779d-150400.3.3.1
python3-susemanager-retail - addressed in versions 1.0.1653987003.92d4870-150300.3.3.2, 1.0.1658330139.861779d-150400.3.3.1
xmlpull-api - addressed in versions 1.1.3.1-150300.3.3.2, 1.1.3.1-150400.3.3.1
jakarta-commons-validator - addressed in versions 1.1.4-21.150300.21.3.3, 1.1.4-21.150400.21.3.4
supportutils-plugin-salt - update to 1.2.0-150300.3.3.1
apache-commons-csv - addressed in versions 1.2-150300.3.3.2, 1.2-150400.3.3.1
golang-github-prometheus-node_exporter - update to 1.3.0-150200.3.9.3
smdba - addressed in versions 1.7.10-0.150300.3.6.1, 1.7.10-0.150300.3.9.2, 1.7.10-0.150400.4.3.1
mvel2 - addressed in versions 2.2.6.Final-150300.3.3.2, 2.2.6.Final-150400.3.3.1
apache-commons-math3 - addressed in versions 3.2-150300.3.3.2, 3.2-150400.3.3.1
python3-urlgrabber - update to 4.1.0-150400.3.3.1
spacewalk-setup - addressed in versions 4.1.11-150200.3.18.2, 4.2.11-150300.3.15.2, 4.3.10-150400.3.3.3
release-notes-susemanager-proxy - addressed in versions 4.1.15-150200.3.56.1, 4.2.7-150300.3.31.2, 4.2.8-150300.3.40.2
release-notes-susemanager - addressed in versions 4.1.15-150200.3.80.1, 4.2.7-150300.3.44.1, 4.2.8-150300.3.51.2
spacecmd - addressed in versions 4.1.18-150200.4.39.3, 4.2.17-150300.4.21.4, 4.2.18-150300.4.24.3, 4.3.14-150400.3.3.2
spacewalk-utils - addressed in versions 4.1.20-150200.3.30.2, 4.2.16-150300.3.15.5, 4.2.17-150300.3.18.3, 4.3.13-150400.3.3.3
spacewalk-utils-extras - addressed in versions 4.1.20-150200.3.30.2, 4.2.16-150300.3.15.5, 4.2.17-150300.3.18.3, 4.3.13-150400.3.3.3
susemanager-schema - addressed in versions 4.1.26-150200.3.45.4, 4.2.22-150300.3.21.6, 4.2.23-150300.3.24.3, 4.3.13-150400.3.3.3
spacewalk-backend-config-files-tool - addressed in versions 4.1.31-150200.4.50.4, 4.2.22-150300.4.23.1, 4.2.23-150300.4.26.3, 4.3.15-150400.3.3.5
spacewalk-backend-xmlrpc - addressed in versions 4.1.31-150200.4.50.4, 4.2.22-150300.4.23.1, 4.2.23-150300.4.26.3, 4.3.15-150400.3.3.5
spacewalk-backend-xml-export-libs - addressed in versions 4.1.31-150200.4.50.4, 4.2.22-150300.4.23.1, 4.2.23-150300.4.26.3, 4.3.15-150400.3.3.5
spacewalk-backend-tools - addressed in versions 4.1.31-150200.4.50.4, 4.2.22-150300.4.23.1, 4.2.23-150300.4.26.3, 4.3.15-150400.3.3.5
spacewalk-backend-sql-postgresql - addressed in versions 4.1.31-150200.4.50.4, 4.2.22-150300.4.23.1, 4.2.23-150300.4.26.3, 4.3.15-150400.3.3.5
spacewalk-backend-sql - addressed in versions 4.1.31-150200.4.50.4, 4.2.22-150300.4.23.1, 4.2.23-150300.4.26.3, 4.3.15-150400.3.3.5
spacewalk-backend-server - addressed in versions 4.1.31-150200.4.50.4, 4.2.22-150300.4.23.1, 4.2.23-150300.4.26.3, 4.3.15-150400.3.3.5
spacewalk-backend-package-push-server - addressed in versions 4.1.31-150200.4.50.4, 4.2.22-150300.4.23.1, 4.2.23-150300.4.26.3, 4.3.15-150400.3.3.5
spacewalk-backend-iss-export - addressed in versions 4.1.31-150200.4.50.4, 4.2.22-150300.4.23.1, 4.2.23-150300.4.26.3, 4.3.15-150400.3.3.5
spacewalk-backend-iss - addressed in versions 4.1.31-150200.4.50.4, 4.2.22-150300.4.23.1, 4.2.23-150300.4.26.3, 4.3.15-150400.3.3.5
spacewalk-backend-config-files-common - addressed in versions 4.1.31-150200.4.50.4, 4.2.22-150300.4.23.1, 4.2.23-150300.4.26.3, 4.3.15-150400.3.3.5
spacewalk-backend-config-files - addressed in versions 4.1.31-150200.4.50.4, 4.2.22-150300.4.23.1, 4.2.23-150300.4.26.3, 4.3.15-150400.3.3.5
spacewalk-backend-applet - addressed in versions 4.1.31-150200.4.50.4, 4.2.22-150300.4.23.1, 4.2.23-150300.4.26.3, 4.3.15-150400.3.3.5
spacewalk-backend-app - addressed in versions 4.1.31-150200.4.50.4, 4.2.22-150300.4.23.1, 4.2.23-150300.4.26.3, 4.3.15-150400.3.3.5
spacewalk-backend - addressed in versions 4.1.31-150200.4.50.4, 4.2.22-150300.4.23.1, 4.2.23-150300.4.26.3, 4.3.15-150400.3.3.5
susemanager-web-libs - update to 4.1.34-150200.3.47.6
spacewalk-base-minimal - addressed in versions 4.1.34-150200.3.47.6, 4.2.27-150300.3.21.7, 4.2.28-150300.3.24.3, 4.3.23-150400.3.3.4
spacewalk-base-minimal-config - addressed in versions 4.1.34-150200.3.47.6, 4.2.27-150300.3.21.7, 4.2.28-150300.3.24.3, 4.3.23-150400.3.3.4
spacewalk-html - addressed in versions 4.1.34-150200.3.47.6, 4.2.27-150300.3.21.7, 4.2.28-150300.3.24.3, 4.3.23-150400.3.3.4
spacewalk-base - addressed in versions 4.1.34-150200.3.47.6, 4.2.27-150300.3.21.7, 4.2.28-150300.3.24.3, 4.3.23-150400.3.3.4
susemanager-tools - addressed in versions 4.1.36-150200.3.52.1, 4.2.32-150300.3.31.1, 4.2.35-150300.3.36.1, 4.3.18-150400.3.3.2
susemanager - addressed in versions 4.1.36-150200.3.52.1, 4.2.32-150300.3.31.1, 4.2.35-150300.3.36.1, 4.3.18-150400.3.3.2
susemanager-sls - addressed in versions 4.1.36-150200.3.64.2, 4.2.23-150300.3.25.4, 4.2.26-150300.3.30.1, 4.3.24-150400.3.3.1
uyuni-config-modules - addressed in versions 4.1.36-150200.3.64.2, 4.2.23-150300.3.25.4, 4.2.26-150300.3.30.1, 4.3.24-150400.3.3.1
spacewalk-java - addressed in versions 4.1.46-150200.3.71.5, 4.2.38-150300.3.35.1, 4.2.40-150300.3.40.2, 4.3.35-150400.3.3.5
spacewalk-java-config - addressed in versions 4.1.46-150200.3.71.5, 4.2.38-150300.3.35.1, 4.2.40-150300.3.40.2, 4.3.35-150400.3.3.5
spacewalk-java-lib - addressed in versions 4.1.46-150200.3.71.5, 4.2.38-150300.3.35.1, 4.2.40-150300.3.40.2, 4.3.35-150400.3.3.5
spacewalk-java-postgresql - addressed in versions 4.1.46-150200.3.71.5, 4.2.38-150300.3.35.1, 4.2.40-150300.3.40.2, 4.3.35-150400.3.3.5
spacewalk-taskomatic - addressed in versions 4.1.46-150200.3.71.5, 4.2.38-150300.3.35.1, 4.2.40-150300.3.40.2, 4.3.35-150400.3.3.5
patterns-suma_server - update to 4.1-150200.6.12.2
patterns-suma_retail - update to 4.1-150200.6.12.2
susemanager-docs_en - addressed in versions 4.1-150200.11.55.2, 4.2-150300.12.27.1, 4.2-150300.12.30.2, 4.3-150400.9.3.1
susemanager-docs_en-pdf - addressed in versions 4.1-150200.11.55.2, 4.2-150300.12.27.1, 4.2-150300.12.30.2, 4.3-150400.9.3.1
susemanager-doc-indexes - addressed in versions 4.1-150200.11.55.4, 4.2-150300.12.27.6, 4.2-150300.12.30.3
spacewalk-search - addressed in versions 4.2.7-150300.3.9.2, 4.3.6-150400.3.3.3
spacewalk-admin - update to 4.2.11-150300.3.12.3
susemanager-sync-data - addressed in versions 4.2.12-150300.3.18.3, 4.2.13-150300.3.21.2
spacewalk-branding - update to 4.2.14-150300.3.12.3
spacewalk-certs-tools - addressed in versions 4.2.16-150300.3.18.3, 4.2.17-150300.3.21.2, 4.3.14-150400.3.3.2
python3-spacewalk-certs-tools - addressed in versions 4.2.16-150300.3.18.3, 4.2.17-150300.3.21.2, 4.3.14-150400.3.3.2
spacewalk-client-tools - addressed in versions 4.2.19-150300.4.21.3, 4.3.11-150400.3.3.4
python3-spacewalk-client-tools - addressed in versions 4.2.19-150300.4.21.3, 4.3.11-150400.3.3.4
spacewalk-postgresql - update to 4.3.5-150400.3.3.2
spacewalk-common - update to 4.3.5-150400.3.3.2
python3-uyuni-common-libs - update to 4.3.5-150400.3.3.2
spacewalk-config - update to 4.3.9-150400.3.3.3
susemanager-schema-utility - update to 4.3.13-150400.3.3.3
woodstox - addressed in versions 4.4.2-150300.3.3.2, 4.4.2-150400.3.3.1
reprepro - update to 5.3.0-150400.3.3.1
reprepro-debugsource - update to 5.3.0-150400.3.3.1
reprepro-debuginfo - update to 5.3.0-150400.3.3.1
drools - addressed in versions 7.17.0-150300.4.3.2, 7.17.0-150400.3.3.1
kie-api - addressed in versions 7.17.0-150300.4.3.2, 7.17.0-150400.3.3.1
optaplanner - addressed in versions 7.17.0-150300.4.3.2, 7.17.0-150400.3.3.1
susemanager-build-keys-web - update to 15.4.3-150400.3.3.1
susemanager-build-keys - update to 15.4.3-150400.3.3.1
postgresql-jdbc - update to 42.2.10-150200.3.8.2
py27-compat-salt - addressed in versions 3000.3-150200.6.24.2, 3000.3-150300.7.7.20.2

• https://bugzilla.suse.com/show_bug.cgi?id=1199629

• Multiple vulnerabilities in Uyuni SUSE Manager
• SUSE update for Recommended update for SUSE Manager 4.1.15 Release Notes
• SUSE update for SUSE Manager Server 4.2
• SUSE update for SUSE Manager Server 4.1
• SUSE update for release-notes-susemanager, release-notes-susemanager-proxy
• SUSE update for Important update for SUSE Manager 4.2.8 Release Notes
• SUSE update for SUSE Manager Server 4.2
• SUSE update for SUSE Manager Server 4.3