7.8

CVE-2022-27229

Path transversal in some Intel(R) NUC Kits NUC7i3DN, NUC7i5DN, NUC7i7DN HDMI firmware update tool software before version 1.79.1.1 may allow an authenticated user to potentially enable escalation of privilege via local access.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Intel ≫ Hdmi Firmware Version < 1.79.1.1
   Intel ≫ Nuc 7 Business Nuc7i3dnhnc Version-
   Intel ≫ Nuc 7 Business Nuc7i3dnktc Version-
   Intel ≫ Nuc 7 Business Nuc7i5dnkpc Version-
   Intel ≫ Nuc 7 Business Nuc7i5dnkpu Version-
   Intel ≫ Nuc Kit Nuc7i3dnhe Version-
   Intel ≫ Nuc Kit Nuc7i3dnke Version-
   Intel ≫ Nuc Kit Nuc7i5dnhe Version-
   Intel ≫ Nuc Kit Nuc7i5dnke Version-
   Intel ≫ Nuc Kit Nuc7i7dnhe Version-
   Intel ≫ Nuc Kit Nuc7i7dnke Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.1% 0.244
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
secure@intel.com 6.7 0.8 5.9
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

CWE-249 DEPRECATED: Often Misused: Path Manipulation

This entry has been deprecated because of name confusion and an accidental combination of multiple weaknesses. Most of its content has been transferred to CWE-785.