CVE-2022-37703

3.3 lowEPSS 0.7%

Low (3.3) in amanda amanda. EPSS 0.7% chance of exploitation in the next 30 days.

In Amanda 3.5.1, an information leak vulnerability was found in the calcsize SUID binary. An attacker can abuse this vulnerability to know if a directory exists or not anywhere in the fs. The binary will use `opendir()` as root directly without checking the path, letting the attacker provide an arbitrary path.

Severity

CVSS 3.1

3.3 low

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2022-09-13
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

amanda:amanda

References

http://www.amanda.org/
https://bugs.gentoo.org/870037
https://github.com/MaherAzzouzi/CVE-2022-37703
https://github.com/zmanda/amanda/releases/tag/tag-community-3.5.3
https://lists.debian.org/debian-lts-announce/2023/12/msg00003.html

Check your stack JSON