CVE-2022-32744

HIGH

Samba 4.3.0-4.14.13 - Authentication Bypass via Kpasswd Request Spoofing

Title source: llm

Description

A flaw was found in Samba. The KDC accepts kpasswd requests encrypted with any key known to it. By encrypting forged kpasswd requests with its own key, a user can change other users' passwords, enabling full domain takeover.

References (2)

Core 2

Core References

Third Party Advisory vendor-advisory

https://security.gentoo.org/glsa/202309-06

Patch, Vendor Advisory

https://www.samba.org/samba/security/CVE-2022-32744.html

Scores

CVSS v3 8.8

EPSS 0.0052

EPSS Percentile 66.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-290

Status published

Products (1)

samba/samba 4.3.0 - 4.14.14

Published Aug 25, 2022

Tracked Since Feb 18, 2026