CVE-2022-34298
Published: 23 June 2022
Summary
CVE-2022-34298 is a medium-severity an unspecified weakness vulnerability in Openidentityplatform Openam. Its CVSS base score is 5.3 (Medium).
Operationally, ranked in the top 2.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The NT auth module in OpenAM versions prior to 14.6.6 is affected by a vulnerability that permits a replace Samba username attack. The issue carries a CVSS 3.1 base score of 5.3 and is reachable over the network without authentication or user interaction, resulting in limited integrity impact while leaving confidentiality and availability unaffected.
An unauthenticated remote attacker can leverage the flaw to perform username substitution during NT authentication flows that involve Samba, thereby altering authentication outcomes in a limited fashion. The attack requires no privileges and targets the identity-management component directly.
The referenced GitHub release notes and pull request for OpenAM 14.6.6 document the corrective changes that address the Samba username handling weakness; upgrading to that version or later eliminates the exposure. The associated EPSS score has remained at 0.4507 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-6121
Vulnerability details
The NT auth module in OpenAM before 14.6.6 allows a "replace Samba username attack."
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.