CVE-2022-32744 is a high-severity flaw in Samba that allows an authenticated attacker to change other users' passwords, potentially leading to full domain takeover. The vulnerability stems from the KDC accepting kpasswd requests encrypted with any known key. With a CVSS score of 8.8, this vulnerability has a low attack complexity and no user interaction required, enabling significant impact on confidentiality, integrity, and availability. While no public exploits or active exploitation have been observed, and community discussion is minimal, the potential for domain compromise necessitates prompt patching.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 4.3.0, < 4.14.14CPE matchmatch criteria | cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:* | ||
>= 4.15.0, < 4.15.9CPE matchmatch criteria | cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:* | ||
>= 4.16.0, < 4.16.4CPE matchmatch criteria | cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2022-32744
Oct 8, 2024AS-2022-014: Samba
Dec 27, 2022A flaw was found in Samba. The KDC accepts kpasswd requests encrypted with any key known to it. By encrypting forged kpasswd requests with its own key a user can change other users' passwords enabling full domain takeover.
Aug 9, 2022samba: AD users can forge password change requests for any user
Jul 27, 2022