high8.8
CVE-2022-32744
A flaw was found in Samba.
Impact
A flaw was found in Samba. The KDC accepts kpasswd requests encrypted with any key known to it. By encrypting forged kpasswd requests with its own key, a user can change other users' passwords, enabling full domain takeover.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Samba | Samba | from 4.3.0 before 4.14.14 from 4.15.0 before 4.15.9 from 4.16.0 before 4.16.4 |