Lucene search

LenovoCVELIST:CVE-2022-3700

HistoryOct 27, 2023 - 7:32 p.m.

CVE-2022-3700

2023-10-2719:32:04

CWE-367

lenovo

www.cve.org

cve-2022-3700

time of check

time of use

lenovo vantage

systemupdate plugin

local attacker

delete files

CVSS3

6.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

AI Score

6.5

Confidence

High

EPSS

Percentile

5.1%

JSON

A Time of Check Time of Use (TOCTOU) vulnerability was reported in the Lenovo Vantage SystemUpdate Plugin version 2.0.0.212 and earlier that could allow a local attacker to delete arbitrary files.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Vantage SystemUpdate Plugin",
    "vendor": "Lenovo",
    "versions": [
      {
        "lessThan": "2.0.0.213",
        "status": "affected",
        "version": " ",
        "versionType": "custom"
      }
    ]
  }
]

References

support.lenovo.com/us/en/product_security/LEN-94532

CVSS3

6.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

AI Score

6.5

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVELIST:CVE-2022-3700