Lucene search

LenovoVULNRICHMENT:CVE-2022-3700

HistoryOct 27, 2023 - 7:32 p.m.

CVE-2022-3700

2023-10-2719:32:04

CWE-367

lenovo

github.com

toctou vulnerability

lenovo vantage systemupdate plugin

arbitrary files deletion

CVSS3

6.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

AI Score

6.8

Confidence

High

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

A Time of Check Time of Use (TOCTOU) vulnerability was reported in the Lenovo Vantage SystemUpdate Plugin version 2.0.0.212 and earlier that could allow a local attacker to delete arbitrary files.

References

support.lenovo.com/us/en/product_security/LEN-94532

CVSS3

6.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

AI Score

6.8

Confidence

High

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Related for VULNRICHMENT:CVE-2022-3700