CVE-2022-37704

Amanda 3.5.1 allows privilege escalation from the regular user backup to root. The SUID binary located at /lib/amanda/rundump will execute /usr/sbin/dump as root with controlled arguments from the attacker which may lead to escalation of privileges, denial of service, and information disclosure.

CVSS v3.1

6.7 MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

6.7 MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0.53% chance of exploitation in the next 30 days, 43th percentile

Published

2023-04-16

Updated

2025-11-04

Proof-of-concept exploits (1)

• MaherAzzouzi/CVE-2022-377044★ · 2022-10-23

References

• CVE Record
• NVD entry

Related

• CVE-2022-37705
• CVE-2022-37706
• CVE-2022-47952
• CVE-2024-26817
• CVE-2022-3769
• CVE-2022-3768