CVE-2023-32183

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Incorrect Default Permissions vulnerability in the openSUSE Tumbleweed hawk2 package allows users with access to the hacluster to escalate to root This issue affects openSUSE Tumbleweed.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-276

Affected software

No affected versions have been published.

Timeline

Published
Jul 7, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-321847.8A Insecure Storage of Sensitive Information vulnerability in openSUSE opensuse-welcome allows local attackers to execute code as the user thCVE-2023-321867.5A Allocation of Resources Without Limits or Throttling vulnerability in SUSE RKE2 allows attackers with access to K3s servers apiserver/supCVE-2023-321877.5An Allocation of Resources Without Limits or Throttling vulnerability in SUSE k3s allows attackers with access to K3s servers' apiserver/supCVE-2023-321889.4A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector TokeCVE-2023-321895.9Insecure handling of ssh keys used to bootstrap clients allows local attackers to potentially gain access to the keysCVE-2023-32195.3The EventON WordPress plugin before 2.1.2 does not validate that the event_id parameter in its eventon_ics_download ajax action is a valid ECVE-2023-321907.8mlocate's %post script allows RUN_UPDATEDB_AS user to make arbitrary files world readable by abusing insecure file operations that run with CVE-2023-321919.9When RKE provisions a cluster, it stores the cluster state in a configmap called `full-cluster-state` inside the `kube-system` namespace of CVE-2023-321928.3A vulnerability has been identified in which unauthenticated cross-site scripting (XSS) in the API Server's public API endpoint can be expCVE-2023-321938.3A vulnerability has been identified in which unauthenticated cross-site scripting (XSS) in Norman's public API endpoint can be exploited. TCVE-2023-321947.2A vulnerability has been identified when granting a create or * global role for a resource type of "namespaces"; no matter the API group, thCVE-2023-321966.6A vulnerability has been identified whereby privilege escalation checks are not properly enforced for RoleTemplateobjects when external=true