CVE-2022-3368

EPSS 5.18%
Veröffentlicht 17.10.2022 21:15:10
Zuletzt bearbeitet 10.05.2025 03:15:21
Quelle security@nortonlifelock.com
CVE-Watchlists
Login
Unerledigt
Login

A vulnerability within the Software Updater functionality of Avira Security for Windows allowed an attacker with write access to the filesystem, to escalate his privileges in certain scenarios. The issue was fixed with Avira Security version 1.1.72.30556.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 4

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Avira ≫ Avira Security SwPlatformwindows Version <= 1.1.71.30554

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	5.18%	0.894

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	8.8	2.8	5.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
security@nortonlifelock.com	7.3	1.3	5.9	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CWE-276 Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

https://support.norton.com/sp/static/external/tools/security-advisories.html

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2022-3368

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2022-3368

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2022-3368

EUVD