Back to Database
Status published
Unknown
CVE-2022-37704
Amanda 3.5.1 allows privilege escalation from the regular user backup...
Vulnerability Description
Amanda 3.5.1 allows privilege escalation from the regular user backup to root. The SUID binary located at /lib/amanda/rundump will execute /usr/sbin/dump as root with controlled arguments from the attacker which may lead to escalation of privileges, denial of service, and information disclosure.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-37704
Credits & Attribution
No credits recorded in the NVD database.
References
- http://www.amanda.org/
- https://github.com/MaherAzzouzi/CVE-2022-37704
- https://github.com/zmanda/amanda/issues/192
- https://marc.info/?l=amanda-hackers
- https://lists.debian.org/debian-lts-announce/2023/02/msg00025.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ATMGMVS3QDN6OMKMHGUTUTU7NS7HR3BZ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JYREA6LFXF5M7K4WLNJV5VNQPS4MTBW2/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5DCLSX5YYTWMKSMDL67M5STZ5ZDSOXK/
- https://github.com/zmanda/amanda/pull/197
- https://github.com/zmanda/amanda/pull/205
- https://github.com/zmanda/amanda/releases/tag/tag-community-3.5.3
More from zmanda
View All →CVE-2022-37705
A privilege escalation flaw was found in Amanda 3.5.1 in...
Medium
6.7
CVE-2019-19469
In Zmanda Management Console 3.3.9, ZMC_Admin_Advanced?form=adminTasks&action=Apply&command= allows CSRF, as demonstrated...
High
8.8
CVE-2016-10730
An issue was discovered in Amanda 3.3.1. A user with...
High
7.8
CVE-2016-10729
An issue was discovered in Amanda 3.3.1. A user with...
High
7.8
CVE-2009-3102
The doHotCopy subroutine in socket-server.pl in Zmanda Recovery Manager (ZRM)...
Critical
10
Affected Vendor
zmanda
View all reports →Affected Software
amanda
Vulnerable Versions:
3.5.1
Timeline
Official Publish:
April 16th, 2023
Last Modified:
November 4th, 2025
Added to House:
July 21st, 2026
CVSS Vectors
No vector data available
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.