cvelist/2020/8xxx/CVE-2020-8345.json

{
    "CVE_data_meta": {
        "ASSIGNER": "psirt@lenovo.com",
        "ID": "CVE-2020-8345",
        "STATE": "PUBLIC"
    },
    "affects": {
        "vendor": {
            "vendor_data": [
                {
                    "product": {
                        "product_data": [
                            {
                                "product_name": "Vantage HardwareScan Plugin",
                                "version": {
                                    "version_data": [
                                        {
                                            "version_affected": "<",
                                            "version_value": "1.0.46.11"
                                        }
                                    ]
                                }
                            }
                        ]
                    },
                    "vendor_name": "Lenovo"
                }
            ]
        }
    },
    "credit": [
        {
            "lang": "eng",
            "value": "Lenovo thanks Security Advisor, Anders Kusk, Improsec ApS for reporting this issue."
        }
    ],
    "data_format": "MITRE",
    "data_type": "CVE",
    "data_version": "4.0",
    "description": {
        "description_data": [
            {
                "lang": "eng",
                "value": "A DLL search path vulnerability was reported in the Lenovo HardwareScan Plugin for the Lenovo Vantage hardware scan feature prior to version 1.0.46.11 that could allow escalation of privilege."
            }
        ]
    },
    "generator": {
        "engine": "Vulnogram 0.0.9"
    },
    "impact": {
        "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
        }
    },
    "problemtype": {
        "problemtype_data": [
            {
                "description": [
                    {
                        "lang": "eng",
                        "value": "CWE-427 Uncontrolled Search Path Element"
                    }
                ]
            }
        ]
    },
    "references": {
        "reference_data": [
            {
                "refsource": "MISC",
                "url": "https://support.lenovo.com/us/en/product_security/LEN-44421",
                "name": "https://support.lenovo.com/us/en/product_security/LEN-44421"
            }
        ]
    },
    "solution": [
        {
            "lang": "eng",
            "value": "Update the Lenovo HardwareScan Plugin to version 1.0.46.11.\n\nThe Lenovo HardwareScan Plugin is automatically updated by the Lenovo System Interface Foundation Service. To immediately start the update process, reboot the computer or restart the \"System Interface Foundation Service\" service.\n\nTo verify the Lenovo HardwareScan Plugin version:\nOpen File Explorer and navigate to C:\\ProgramData\\Lenovo\\ImController\\Plugins\\LenovoHardwareScanPlugin\\x64\nRight click on LenovoHardwareScanPlugin.dll and select Properties.\nClick on the Details tab.\nRead the File version."
        }
    ],
    "source": {
        "advisory": "LEN-44421",
        "discovery": "UNKNOWN"
    }
}