PT-2023-1476 · Microsoft · Windows 10

Published 2023-02-02 · Updated 2025-03-25 · CVE-2022-38396

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Windows 10 versions prior to 21H2

Description The issue is related to HP Factory Preinstalled Images on certain systems shipped with Windows 10, where escalation of privilege might occur via execution of certain files outside the restricted path. This is due to incorrect restriction of the directory path name with limited access. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

Recommendations For Windows 10 versions prior to 21H2, update to Windows 10 version 21H2 or later to resolve the issue.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2023-00885

CVE-2022-38396

Affected Products

Windows 10

References · 6

• https://support.hp.com/ie-en/document/ish_7620368-7620413-16 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00885 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-38396 · Security Note
• https://t.me/cvenotify/116255 · Telegram Post
• https://t.me/cvenotify/44145 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38396 · Note