CVE-2023-32183

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Incorrect Default Permissions vulnerability in the openSUSE Tumbleweed hawk2 package allows users with access to the hacluster to escalate to root This issue affects openSUSE Tumbleweed.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-276

Affected software

Vendor	Product	Versions
openSUSE	Tumbleweed	—

References

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32183Exploit, Issue Tracking, Vendor Advisory
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32183Exploit, Issue Tracking, Vendor Advisory

Timeline

Published: Jul 7, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-321847.8A Insecure Storage of Sensitive Information vulnerability in openSUSE opensuse-welcome allows local attackers to execute code as the user th CVE-2023-321867.5A Allocation of Resources Without Limits or Throttling vulnerability in SUSE RKE2 allows attackers with access to K3s servers apiserver/sup CVE-2023-321877.5An Allocation of Resources Without Limits or Throttling vulnerability in SUSE k3s allows attackers with access to K3s servers' apiserver/sup CVE-2023-321889.4A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Toke CVE-2023-321895.9Insecure handling of ssh keys used to bootstrap clients allows local attackers to potentially gain access to the keys CVE-2023-32195.3The EventON WordPress plugin before 2.1.2 does not validate that the event_id parameter in its eventon_ics_download ajax action is a valid E CVE-2023-321907.8mlocate's %post script allows RUN_UPDATEDB_AS user to make arbitrary files world readable by abusing insecure file operations that run with CVE-2023-321919.9When RKE provisions a cluster, it stores the cluster state in a configmap called `full-cluster-state` inside the `kube-system` namespace of CVE-2023-321928.3A vulnerability has been identified in which unauthenticated cross-site scripting (XSS) in the API Server's public API endpoint can be exp CVE-2023-321938.3A vulnerability has been identified in which unauthenticated cross-site scripting (XSS) in Norman's public API endpoint can be exploited. T CVE-2023-321947.2A vulnerability has been identified when granting a create or * global role for a resource type of "namespaces"; no matter the API group, th CVE-2023-321966.6A vulnerability has been identified whereby privilege escalation checks are not properly enforced for RoleTemplateobjects when external=true