Intel® DCM Software Advisory

Summary:

Potential security vulnerabilities in the Intel® Data Center Manager (DCM) software may allow escalation of privilege. Intel is releasing software updates to mitigate these potential vulnerabilities.

Vulnerability Details:

CVEID: CVE-2022-44619

Description: Insecure storage of sensitive information in the Intel® DCM software before version 5.1 may allow an authenticated user to potentially enable escalation of privilege via local access.

CVSS Base Score: 8.2 High

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

CVEID: CVE-2022-41998

Description: Uncontrolled search path in the Intel® DCM software before version 5.1 may allow an authenticated user to potentially enable escalation of privilege via local access.

CVSS Base Score: 6.7 Medium

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

CVEID: CVE-2022-43475

Description: Insecure storage of sensitive information in the Intel® DCM software before version 5.1 may allow an authenticated user to potentially enable escalation of privilege via local access.

CVSS Base Score: 6.0 Medium

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

CVEID: CVE-2022-41979

Description: Protection mechanism failure in the Intel® DCM software before version 5.1 may allow an authenticated user to potentially enable escalation of privilege via network access.

CVSS Base Score: 5.4 Medium

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

CVEID: CVE-2022-44610

Description: Improper authentication in the Intel® DCM software before version 5.1 may allow an authenticated user to potentially enable escalation of privilege via network access.

CVSS Base Score: 5.4 Medium

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L****

Affected Products:

Intel® DCM software before version 5.1.

Recommendations:

Intel recommends that users of Intel® DCM update to 5.1or later.

Updates are available for download at this location:

<https://www.intel.com/content/www/us/en/download/645992&gt;

Acknowledgements:

Intel would like to thank Marius Gabriel Mihai for reporting this issue CVE-2022-41998.

Intel would like to thank Intel employees Alexander V Gutkin, Sushmith M Hiremath & Cezary Golder for finding these issues CVE-2022-44619, CVE-2022-43475, CVE-2022-41979 and CVE-2022-44610.

Intel, and nearly the entire technology industry, follows a disclosure practice called Coordinated Disclosure, under which a cybersecurity vulnerability is generally publicly disclosed only after mitigations are available.