CVE-2022-2104

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The www-data (Apache web server) account is configured to run sudo with no password for many commands (including /bin/sh and /bin/bash).

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published
Jun 24, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-21059.1Client-side JavaScript controls may be bypassed to change user credentials and permissions without authentication, including a “root” user lCVE-2022-21062.7Elcomplus SmartICS v2.3.4.0 does not validate the filenames sufficiently, which enables authenticated administrator-level users to perform pCVE-2022-21079.8The MiCODUS MV720 GPS tracker API server has an authentication mechanism that allows devices to use a hard-coded master password. This may aCVE-2022-21085.3The plugin Wbcom Designs – BuddyPress Group Reviews for WordPress is vulnerable to unauthorized settings changes and review modification dueCVE-2022-21118.8Unrestricted Upload of File with Dangerous Type in GitHub repository inventree/inventree prior to 0.7.2.CVE-2022-21128.8Improper Neutralization of Formula Elements in a CSV File in GitHub repository inventree/inventree prior to 0.7.2.CVE-2022-211229.8The package metacalc before 0.0.2 are vulnerable to Arbitrary Code Execution when it exposes JavaScript's Math class to the v8 context. As tCVE-2022-211235.5Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated user to potentially enable informatiCVE-2022-211247.8Out-of-bounds write vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause iCVE-2022-211255.5Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to potentially enable infoCVE-2022-211267.8The package com.github.samtools:htsjdk before 3.0.1 are vulnerable to Creation of Temporary File in Directory with Insecure Permissions due CVE-2022-211275.5Incomplete cleanup in specific special register read operations for some Intel(R) Processors may allow an authenticated user to potentially
CVE-2022-2104: Critical severity, CVSS 9.8 | Vulnix