CVE-2022-36374

2023-11-1419:15:12

CWE-284

intel

web.nvd.nist.gov

cve-2022-36374

intel

aptio

uefi firmware

access control

privilege escalation

CVSS3

7.5

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS

Percentile

9.0%

JSON

Improper access control in some Intel® Aptio* V UEFI Firmware Integrator Tools before version iDmi Windows 5.27.03.0003 may allow a privileged user to potentially enable escalation of privilege via local access.

Affected configurations

Nvd

Vulnrichment

Node

intelaptio_v_uefi_firmware_integrator_toolsMatch5.27.03.0003

AND

microsoftwindowsMatch-

Node

intelaptio_v_uefi_firmware_integrator_toolsMatch5.27.06.0017

AND

linuxlinux_kernelMatch-

VendorProductVersionCPE
intelaptio_v_uefi_firmware_integrator_tools5.27.03.0003cpe:2.3:a:intel:aptio_v_uefi_firmware_integrator_tools:5.27.03.0003:*:*:*:*:*:*:*
microsoftwindows-cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
intelaptio_v_uefi_firmware_integrator_tools5.27.06.0017cpe:2.3:a:intel:aptio_v_uefi_firmware_integrator_tools:5.27.06.0017:*:*:*:*:*:*:*
linuxlinux_kernel-cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
intel	aptio_v_uefi_firmware_integrator_tools	5.27.03.0003	cpe:2.3:a:intel:aptio_v_uefi_firmware_integrator_tools:5.27.03.0003:::::::*
microsoft	windows	-	cpe:2.3:o:microsoft:windows:-:::::::*
intel	aptio_v_uefi_firmware_integrator_tools	5.27.06.0017	cpe:2.3:a:intel:aptio_v_uefi_firmware_integrator_tools:5.27.06.0017:::::::*
linux	linux_kernel	-	cpe:2.3:o:linux:linux_kernel:-:::::::*

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "Intel(R) Aptio* V UEFI Firmware Integrator Tools",
    "versions": [
      {
        "version": "before version iDmi Windows 5.27.03.0003",
        "status": "affected"
      }
    ],
    "defaultStatus": "unaffected"
  }
]