PT-2023-1476 · Microsoft · Windows 10

Publicado 2023-02-02 · Atualizado 2025-03-25 · CVE-2022-38396

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Windows 10 versions prior to 21H2

Description The issue is related to HP Factory Preinstalled Images on certain systems shipped with Windows 10, where escalation of privilege might occur via execution of certain files outside the restricted path. This is due to incorrect restriction of the directory path name with limited access. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

Recommendations For Windows 10 versions prior to 21H2, update to Windows 10 version 21H2 or later to resolve the issue.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

BDU:2023-00885

CVE-2022-38396

Produtos afetados

Windows 10

Referências · 6

• https://support.hp.com/ie-en/document/ish_7620368-7620413-16 · Aviso do Fabricante
• https://t.me/cvenotify/116255 · Publicação no Telegram
• https://t.me/cvenotify/44145 · Publicação no Telegram
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38396 · Nota
• https://bdu.fstec.ru/vul/2023-00885 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2022-38396 · Nota de Segurança