Lucene search

LenovoCVE-2019-6173

HistoryJun 09, 2020 - 8:15 p.m.

CVE-2019-6173

2020-06-0920:15:11

CWE-426

lenovo

web.nvd.nist.gov

cve-2019-6173

lenovo

dll search path

privilege escalation

installation packages

nvd

CVSS2

6.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

AI Score

6.8

Confidence

High

EPSS

Percentile

12.6%

JSON

A DLL search path vulnerability could allow privilege escalation in some Lenovo installation packages, prior to version 1.2.9.3, during installation if an attacker already has administrative privileges.

Affected configurations

Nvd

Node

lenovoinstallation_packageRange<1.2.9.3

VendorProductVersionCPE
lenovoinstallation_package*cpe:2.3:a:lenovo:installation_package:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
lenovo	installation_package	*	cpe:2.3:a:lenovo:installation_package::::::::

CNA Affected

[
  {
    "product": "Installation Packages",
    "vendor": "Lenovo",
    "versions": [
      {
        "lessThan": "1.2.9.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

support.lenovo.com/us/en/product_security/len-27431

CVSS2

6.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

AI Score

6.8

Confidence

High

EPSS

Percentile

12.6%

JSON

Related for CVE-2019-6173