7.8
CVE-2022-42292
- EPSS 0.04%
- Veröffentlicht 12.02.2023 04:15:15
- Zuletzt bearbeitet 21.11.2024 07:24:41
- Quelle psirt@nvidia.com
- Teams Watchlist Login
- Unerledigt Login
NVIDIA GeForce Experience contains a vulnerability in the NVContainer component, where a user without administrator privileges can create a symbolic link to a file that requires elevated privileges to write to or modify, which may lead to denial of service, escalation of privilege or limited data tampering.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Nvidia ≫ Geforce Experience Version < 3.27.0.112
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.04% | 0.076 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.8 | 1.8 | 5.9 |
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
| psirt@nvidia.com | 5 | 0.8 | 4.2 |
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:H
|
CWE-59 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.