PT-2016-7596 · Nvidia · Nvidia Web Helper.Exe+1

Publicado 2016-12-16 · Atualizado 2021-02-11 · CVE-2016-8827

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions NVIDIA GeForce Experience versions 3.x before 3.1.0.52

Description The issue concerns a lack of proper access control and parameter validation in the NVIDIA Web Helper.exe, specifically affecting the local web API endpoint "/VisualOPS/v.1.0./". This allows for information disclosure via a directory traversal attack.

Recommendations For versions prior to 3.1.0.52, update to version 3.1.0.52 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/VisualOPS/v.1.0./" API endpoint until a patch is applied.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2016-8827

Produtos afetados

Nvidia Geforce Experience

Nvidia Web Helper.Exe

Referências · 7

• http://securityfocus.com/bid/94964 · Nota
• https://nvidia.custhelp.com/app/answers/detail/a_id/5033 · Aviso do Fabricante
• http://nvidia.custhelp.com/app/answers/detail/a_id/4279 · Aviso do Fabricante
• https://nvidia.custhelp.com/app/answers/detail/a_id/5155 · Nota
• https://osv.dev/vulnerability/CVE-2016-8827 · Aviso do Fabricante
• https://t.me/cvenotify/9529 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2016-8827 · Nota de Segurança