CVE-2022-37030

HIGH 7.8CVE-2022-37030 · Published 04/08/2022 · updated 17/06/2026

In short

CVE-2022-37030 is a HIGH (CVSS 7.8) vulnerability affecting gromox (grommunio).
Chance of exploitation in the next 30 days (EPSS): 0.34%, higher than 27.4% of all vulnerabilities.
Fix: update to 1.28 or later.

Package	Affected versions	Patched versions
gromox grommunio	`≥ 0.5, < 1.28`	`1.28`

Description

Weak permissions on the configuration file in the PAM module in Grommunio Gromox 0.5 through 1.x before 1.28 allow a local unprivileged user in the gromox group to have the PAM stack execute arbitrary code upon loading the Gromox PAM module.

References

openwall.com/lists/oss-security/2022/08/04/1 · Mailing List
bugzilla.suse.com/show_bug.cgi · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free