We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

THREATINT
PUBLISHED

CVE-2025-46811

SUSE Multi Linux Manager has unprotected websocket endpoint



Description

A Missing Authentication for Critical Function vulnerability in SUSE Manager allows anyone with access to the websocket at /rhn/websocket/minion/remote-commands to execute arbitrary commands as root. This issue affects Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1: from ? before 0.3.7-150600.3.6.2; Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1: from ? before 5.0.14-150600.4.17.1; Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1: from ? before 5.0.14-150600.4.17.1; Image SLES15-SP4-Manager-Server-4-3-BYOS: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE: from ? before 4.3.33-150400.3.55.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE: from ? before 4.3.33-150400.3.55.2; SUSE Manager Server Module 4.3: from ? before 0.3.7-150400.3.39.4; SUSE Manager Server Module 4.3: from ? before 4.3.33-150400.3.55.2; SUSE Manager Server Module 4.3: from ? before 4.3.33-150400.3.55.2.

Reserved 2025-04-30 | Published 2025-07-30 | Updated 2025-07-30 | Assigner suse


CRITICAL: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CRITICAL: 9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Problem types

CWE-306: Missing Authentication for Critical Function

Product status

Default status
unaffected

? before 0.3.7-150600.3.6.2
affected

Default status
unaffected

? before 5.0.14-150600.4.17.1
affected

Default status
unaffected

? before 5.0.14-150600.4.17.1
affected

Default status
unaffected

? before 4.3.33-150400.3.55.2
affected

Default status
unaffected

? before 4.3.33-150400.3.55.2
affected

Default status
unaffected

? before 4.3.33-150400.3.55.2
affected

Default status
unaffected

? before 4.3.33-150400.3.55.2
affected

Default status
unaffected

? before 4.3.33-150400.3.55.2
affected

Default status
unaffected

? before 4.3.33-150400.3.55.2
affected

Default status
unaffected

? before 4.3.33-150400.3.55.2
affected

Default status
unaffected

? before 4.3.33-150400.3.55.2
affected

Default status
unaffected

? before 0.3.7-150400.3.39.4
affected

Default status
unaffected

? before 4.3.33-150400.3.55.2
affected

Default status
unaffected

? before 4.3.33-150400.3.55.2
affected

Credits

Simon Holl (MindBytes) finder

References

bugzilla.suse.com/show_bug.cgi?id=CVE-2025-46811

cve.org (CVE-2025-46811)

nvd.nist.gov (CVE-2025-46811)

Download JSON

Share this page
https://cve.threatint.eu/CVE/CVE-2025-46811

Support options

Helpdesk Chat, Email, Knowledgebase
© Copyright 2025 THREATINT
Made in Cyprus with ❤ + ☼
 System status
Find us on
Data Privacy
Terms of Use
Logo BSI Allianz für Cyber-Sicherheit
Error loading Crisp.chat. Please check your web content filter and browser plugins.