Lucene search

LenovoCVE-2022-3700

HistoryOct 27, 2023 - 8:15 p.m.

CVE-2022-3700

2023-10-2720:15:08

CWE-367

lenovo

web.nvd.nist.gov

cve-2022-3700

time of check time of use

toctou

lenovo vantage

systemupdate plugin

nvd

local attacker

file deletion

CVSS3

6.3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

AI Score

6.2

Confidence

High

EPSS

Percentile

5.1%

JSON

A Time of Check Time of Use (TOCTOU) vulnerability was reported in the Lenovo Vantage SystemUpdate Plugin version 2.0.0.212 and earlier that could allow a local attacker to delete arbitrary files.

Affected configurations

Nvd

Node

lenovosystem_update_pluginRange<2.0.0.213lenovo_vantage

Node

lenovohardware_scan_pluginRange<1.3.1.2lenovo_vantage

Node

lenovohardware_scan_addinRange<2.4.1.1lenovo_vantage

VendorProductVersionCPE
lenovosystem_update_plugin*cpe:2.3:a:lenovo:system_update_plugin:*:*:*:*:*:lenovo_vantage:*:*
lenovohardware_scan_plugin*cpe:2.3:a:lenovo:hardware_scan_plugin:*:*:*:*:*:lenovo_vantage:*:*
lenovohardware_scan_addin*cpe:2.3:a:lenovo:hardware_scan_addin:*:*:*:*:*:lenovo_vantage:*:*

Vendor	Product	Version	CPE
lenovo	system_update_plugin	*	cpe:2.3:a:lenovo:system_update_plugin::::::lenovo_vantage::*
lenovo	hardware_scan_plugin	*	cpe:2.3:a:lenovo:hardware_scan_plugin::::::lenovo_vantage::*
lenovo	hardware_scan_addin	*	cpe:2.3:a:lenovo:hardware_scan_addin::::::lenovo_vantage::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Vantage SystemUpdate Plugin",
    "vendor": "Lenovo",
    "versions": [
      {
        "lessThan": "2.0.0.213",
        "status": "affected",
        "version": " ",
        "versionType": "custom"
      }
    ]
  }
]

References

support.lenovo.com/us/en/product_security/LEN-94532

CVSS3

6.3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

AI Score

6.2

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVE-2022-3700