CVE-2022-3700

2023-10-2720:15:08

CWE-367

[email protected]

web.nvd.nist.gov

lenovo vantage

system update plugin

toctou

vulnerability

local attacker

delete files

CVSS3

6.3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

EPSS

Percentile

5.1%

JSON

A Time of Check Time of Use (TOCTOU) vulnerability was reported in the Lenovo Vantage SystemUpdate Plugin version 2.0.0.212 and earlier that could allow a local attacker to delete arbitrary files.

Affected configurations

Nvd

Node

lenovosystem_update_pluginRange<2.0.0.213lenovo_vantage

Node

lenovohardware_scan_pluginRange<1.3.1.2lenovo_vantage

Node

lenovohardware_scan_addinRange<2.4.1.1lenovo_vantage

VendorProductVersionCPE
lenovosystem_update_plugin*cpe:2.3:a:lenovo:system_update_plugin:*:*:*:*:*:lenovo_vantage:*:*
lenovohardware_scan_plugin*cpe:2.3:a:lenovo:hardware_scan_plugin:*:*:*:*:*:lenovo_vantage:*:*
lenovohardware_scan_addin*cpe:2.3:a:lenovo:hardware_scan_addin:*:*:*:*:*:lenovo_vantage:*:*

Vendor	Product	Version	CPE
lenovo	system_update_plugin	*	cpe:2.3:a:lenovo:system_update_plugin::::::lenovo_vantage::*
lenovo	hardware_scan_plugin	*	cpe:2.3:a:lenovo:hardware_scan_plugin::::::lenovo_vantage::*
lenovo	hardware_scan_addin	*	cpe:2.3:a:lenovo:hardware_scan_addin::::::lenovo_vantage::*