CVE-2022-29934

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

USU Oracle Optimization before 5.17.5 lacks Polkit authentication, which allows smartcollector users to achieve root access via pkexec. NOTE: this is not an Oracle Corporation product.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/orangecertcc/security-research/security/advisories/GHSA-4vr2-wxp6-w29vExploit, Third Party Advisory
https://github.com/orangecertcc/security-research/security/advisories/GHSA-4vr2-wxp6-w29vExploit, Third Party Advisory

Timeline

Published: Apr 29, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-299357.5USU Oracle Optimization before 5.17.5 allows attackers to discover the quantum credentials via an agent-installer download. NOTE: this is no CVE-2022-299368.8USU Oracle Optimization before 5.17 allows authenticated quantum users to achieve remote code execution because of /v2/quantum/save-data-upl CVE-2022-299378.8USU Oracle Optimization before 5.17.5 allows authenticated DataCollection users to achieve agent root access because some common OS commands CVE-2022-299388.8In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameter payment_id in interface\billing\new_payment.php via interface\billing\pa CVE-2022-299395.4In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameters debug and InsId in interface\billing\sl_eob_process.php leads to multip CVE-2022-299405.4In LibreHealth EHR 2.0.0, lack of sanitization of the GET parameters formseq and formid in interface\orders\find_order_popup.php leads to mu CVE-2022-299426.5Talend Administration Center has a vulnerability that allows an authenticated user to use the Service Registry 'Add' functionality to perfor CVE-2022-299436.5Talend Administration Center has a vulnerability that allows an authenticated user to use XML External Entity (XXE) processing to achieve re CVE-2022-299445.3An issue was discovered in ONOS 2.5.1. There is an incorrect comparison of paths installed by intents. An existing intents does not redirect CVE-2022-299457.5DJI drone devices sold in 2017 through 2022 broadcast unencrypted information about the drone operator's physical location via the AeroScope CVE-2022-299466.3NATS.io NATS Server before 2.8.2 and Streaming Server before 0.24.6 could allow a remote attacker to bypass security restrictions, caused by CVE-2022-299476.1Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping.