PT-2016-7596 · Nvidia · Nvidia Web Helper.Exe+1

Published 2016-12-16 · Updated 2021-02-11 · CVE-2016-8827

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions NVIDIA GeForce Experience versions 3.x before 3.1.0.52

Description The issue concerns a lack of proper access control and parameter validation in the NVIDIA Web Helper.exe, specifically affecting the local web API endpoint "/VisualOPS/v.1.0./". This allows for information disclosure via a directory traversal attack.

Recommendations For versions prior to 3.1.0.52, update to version 3.1.0.52 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/VisualOPS/v.1.0./" API endpoint until a patch is applied.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2016-8827

Affected Products

Nvidia Geforce Experience

Nvidia Web Helper.Exe

References · 7

• https://nvidia.custhelp.com/app/answers/detail/a_id/5033 · Vendor Advisory
• http://nvidia.custhelp.com/app/answers/detail/a_id/4279 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-8827 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-8827 · Security Note
• http://securityfocus.com/bid/94964 · Note
• https://nvidia.custhelp.com/app/answers/detail/a_id/5155 · Note
• https://t.me/cvenotify/9529 · Telegram Post