6.7med
CVE-2022-38136
Uncontrolled search path in the Intel(R) oneAPI DPC++/C++ Compiler for Windows and Intel Fortran Compiler for Windows before version 2022.2…
Published 3 y ago · modified 4 mo ago · JSON
CVSS
6.7
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.2%
percentile 9%
Public exploits
0
none known
Summary
Uncontrolled search path in the Intel(R) oneAPI DPC++/C++ Compiler for Windows and Intel Fortran Compiler for Windows before version 2022.2.1 for some Intel(R) oneAPI Toolkits before version 2022.3.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
CISA SSVC assessment
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 21 mo ago
Exploit prediction (EPSS)
0.19% probability of exploitation in the next 30 days, higher than 9% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.1 | 6.7 | CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 6.7 | CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 7.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
Affected products
- n/a Intel(R) oneAPI DPC++/C++ Compiler for Windows and Intel® Fortran Compiler for Windows before version 2022.2.1 for some Intel(R) oneAPI Toolkits
Classification
- Weakness
- CWE-427 Uncontrolled Search Path Element
References
- intel.com /content/www/us/en/security-center/advisory/intel-sa-00773.html · x_transferred
Sources
- CVE List: CVE-2022-38136
- NVD: CVE-2022-38136
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.