Lucene search

LenovoCVE-2022-4433

HistoryJan 05, 2023 - 6:15 p.m.

CVE-2022-4433

2023-01-0518:15:09

CWE-126

CWE-125

lenovo

web.nvd.nist.gov

cve-2022-4433

buffer over-read

thinkpadx13s

bios

lenovosetupconfigdxe

vulnerability

information disclosure

nvd

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

4.5

Confidence

High

EPSS

Percentile

5.1%

JSON

A buffer over-read vulnerability was reported in the ThinkPadX13s BIOS LenovoSetupConfigDxe driver that could allow a local attacker with elevated privileges to cause information disclosure.

Affected configurations

Nvd

Node

lenovothinkpad_x13s_firmwareRange<1.47

AND

lenovothinkpad_x13sMatch-

VendorProductVersionCPE
lenovothinkpad_x13s_firmware*cpe:2.3:o:lenovo:thinkpad_x13s_firmware:*:*:*:*:*:*:*:*
lenovothinkpad_x13s-cpe:2.3:h:lenovo:thinkpad_x13s:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
lenovo	thinkpad_x13s_firmware	*	cpe:2.3:o:lenovo:thinkpad_x13s_firmware::::::::
lenovo	thinkpad_x13s	-	cpe:2.3:h:lenovo:thinkpad_x13s:-:::::::*

CNA Affected

[
  {
    "defaultStatus": "unknown",
    "product": "ThinkPad X13s",
    "vendor": "Lenovo",
    "versions": [
      {
        "status": "affected",
        "version": "Versions prior to 1.47"
      }
    ]
  }
]

References

support.lenovo.com/us/en/product_security/LEN-103709

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

4.5

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVE-2022-4433