CVE-2020-8345 - OpenCVE

A DLL search path vulnerability was reported in the Lenovo HardwareScan Plugin for the Lenovo Vantage hardware scan feature prior to version 1.0.46.11 that could allow escalation of privilege.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

Access Vector Local

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:L/AC:M/Au:N/C:P/I:P/A:P

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Lenovo	Hardware Scan

Configuration 1 [-]

cpe:2.3:a:lenovo:hardware_scan:*:*:*:*:*:lenovo_vantage:*:*

No data.

References

Link	Providers
https://support.lenovo.com/us/en/product_security/LEN-44421

History

No history.

MITRE

Status: PUBLISHED

Assigner: lenovo

Published: 2020-10-14T21:25:20

Updated: 2024-08-04T09:56:28.341Z

Reserved: 2020-01-28T00:00:00

Link: CVE-2020-8345

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2020-10-14T22:15:13.577

Modified: 2020-10-26T14:09:48.547

Link: CVE-2020-8345

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Vantage HardwareScan Plugin", "vendor": "Lenovo", "versions": [{"lessThan": "1.0.46.11", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Lenovo thanks Security Advisor, Anders Kusk, Improsec ApS for reporting this issue."}], "descriptions": [{"lang": "en", "value": "A DLL search path vulnerability was reported in the Lenovo HardwareScan Plugin for the Lenovo Vantage hardware scan feature prior to version 1.0.46.11 that could allow escalation of privilege."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-427", "description": "CWE-427 Uncontrolled Search Path Element", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-10-14T21:25:20", "orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b", "shortName": "lenovo"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://support.lenovo.com/us/en/product_security/LEN-44421"}], "solutions": [{"lang": "en", "value": "Update the Lenovo HardwareScan Plugin to version 1.0.46.11.\n\nThe Lenovo HardwareScan Plugin is automatically updated by the Lenovo System Interface Foundation Service. To immediately start the update process, reboot the computer or restart the \"System Interface Foundation Service\" service.\n\nTo verify the Lenovo HardwareScan Plugin version:\nOpen File Explorer and navigate to C:\\ProgramData\\Lenovo\\ImController\\Plugins\\LenovoHardwareScanPlugin\\x64\nRight click on LenovoHardwareScanPlugin.dll and select Properties.\nClick on the Details tab.\nRead the File version."}], "source": {"advisory": "LEN-44421", "discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@lenovo.com", "ID": "CVE-2020-8345", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Vantage HardwareScan Plugin", "version": {"version_data": [{"version_affected": "<", "version_value": "1.0.46.11"}]}}]}, "vendor_name": "Lenovo"}]}}, "credit": [{"lang": "eng", "value": "Lenovo thanks Security Advisor, Anders Kusk, Improsec ApS for reporting this issue."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A DLL search path vulnerability was reported in the Lenovo HardwareScan Plugin for the Lenovo Vantage hardware scan feature prior to version 1.0.46.11 that could allow escalation of privilege."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-427 Uncontrolled Search Path Element"}]}]}, "references": {"reference_data": [{"name": "https://support.lenovo.com/us/en/product_security/LEN-44421", "refsource": "MISC", "url": "https://support.lenovo.com/us/en/product_security/LEN-44421"}]}, "solution": [{"lang": "en", "value": "Update the Lenovo HardwareScan Plugin to version 1.0.46.11.\n\nThe Lenovo HardwareScan Plugin is automatically updated by the Lenovo System Interface Foundation Service. To immediately start the update process, reboot the computer or restart the \"System Interface Foundation Service\" service.\n\nTo verify the Lenovo HardwareScan Plugin version:\nOpen File Explorer and navigate to C:\\ProgramData\\Lenovo\\ImController\\Plugins\\LenovoHardwareScanPlugin\\x64\nRight click on LenovoHardwareScanPlugin.dll and select Properties.\nClick on the Details tab.\nRead the File version."}], "source": {"advisory": "LEN-44421", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T09:56:28.341Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://support.lenovo.com/us/en/product_security/LEN-44421"}]}]}, "cveMetadata": {"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b", "assignerShortName": "lenovo", "cveId": "CVE-2020-8345", "datePublished": "2020-10-14T21:25:20", "dateReserved": "2020-01-28T00:00:00", "dateUpdated": "2024-08-04T09:56:28.341Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:lenovo:hardware_scan:*:*:*:*:*:lenovo_vantage:*:*", "matchCriteriaId": "5E0EDF80-DA20-4A56-BBE5-4926BF086D2B", "versionEndExcluding": "1.0.46.11", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A DLL search path vulnerability was reported in the Lenovo HardwareScan Plugin for the Lenovo Vantage hardware scan feature prior to version 1.0.46.11 that could allow escalation of privilege."}, {"lang": "es", "value": "Se report\u00f3 una vulnerabilidad en la ruta de b\u00fasqueda de DLL en Lenovo HardwareScan Plugin para la funcionalidad hardware scan de Lenovo Vantage versiones anteriores a 1.0.46.11, que podr\u00eda permitir una escalada de privilegios"}], "id": "CVE-2020-8345", "lastModified": "2020-10-26T14:09:48.547", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.4, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.4, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 5.9, "source": "psirt@lenovo.com", "type": "Secondary"}]}, "published": "2020-10-14T22:15:13.577", "references": [{"source": "psirt@lenovo.com", "tags": ["Vendor Advisory"], "url": "https://support.lenovo.com/us/en/product_security/LEN-44421"}], "sourceIdentifier": "psirt@lenovo.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-427"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-427"}], "source": "psirt@lenovo.com", "type": "Secondary"}]}