Lucene search

K
nvd[email protected]NVD:CVE-2022-33937
HistoryOct 12, 2022 - 8:15 p.m.

CVE-2022-33937

2022-10-1220:15:11
CWE-23
CWE-22
web.nvd.nist.gov
3
dell geodrive
path traversal
local attacker
unauthorized access
nt authority\system

CVSS3

7.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

EPSS

0

Percentile

9.9%

Dell GeoDrive, Versions 1.0 - 2.2, contain a Path Traversal Vulnerability in the reporting function. A local, low privileged attacker could potentially exploit this vulnerability, to gain unauthorized delete access to the files stored on the server filesystem, with the privileges of the GeoDrive service: NT AUTHORITY\SYSTEM.

Affected configurations

Nvd
Node
dellgeodriveRange<2.2.3
VendorProductVersionCPE
dellgeodrive*cpe:2.3:a:dell:geodrive:*:*:*:*:*:*:*:*

CVSS3

7.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

EPSS

0

Percentile

9.9%

Related for NVD:CVE-2022-33937