Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2022-33942 (GCVE-0-2022-33942)
Vulnerability from cvelistv5 – Published: 2022-11-11 15:48 – Updated: 2025-02-05 20:52
VLAI?
EPSS
Summary
Protection mechanism failure in the Intel(R) DCM software before version 5.0 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
Severity ?
8.8 (High)
CWE
- escalation of privilege
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| n/a | Intel(R) DCM software |
Affected:
before version 5.0
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T08:16:15.935Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00713.html",
"tags": [
"x_transferred"
],
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00713.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-33942",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-29T20:41:27.267713Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-693",
"description": "CWE-693 Protection Mechanism Failure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-05T20:52:11.139Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Intel(R) DCM software",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "before version 5.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Protection mechanism failure in the Intel(R) DCM software before version 5.0 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "escalation of privilege",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-11-14T17:46:08.833Z",
"orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"shortName": "intel"
},
"references": [
{
"name": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00713.html",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00713.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
"assignerShortName": "intel",
"cveId": "CVE-2022-33942",
"datePublished": "2022-11-11T15:48:43.742Z",
"dateReserved": "2022-06-17T20:54:11.143Z",
"dateUpdated": "2025-02-05T20:52:11.139Z",
"requesterUserId": "e1538295-92a9-4bd5-bb63-88a76fc3a35c",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:intel:data_center_manager:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"5.0\", \"matchCriteriaId\": \"17F290FC-EC2A-4E64-9E66-5BC9857E55ED\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"Protection mechanism failure in the Intel(R) DCM software before version 5.0 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.\"}, {\"lang\": \"es\", \"value\": \"La falla del mecanismo de protecci\\u00f3n en el software Intel(R) DCM anterior a la versi\\u00f3n 5.0 puede permitir que un usuario no autenticado habilite potencialmente la escalada de privilegios a trav\\u00e9s del acceso adyacente.\"}]",
"id": "CVE-2022-33942",
"lastModified": "2024-11-21T07:08:39.130",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"secure@intel.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"ADJACENT_NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.1, \"impactScore\": 6.0}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"ADJACENT_NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 5.9}]}",
"published": "2022-11-11T16:15:15.097",
"references": "[{\"url\": \"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00713.html\", \"source\": \"secure@intel.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00713.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
"sourceIdentifier": "secure@intel.com",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-Other\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2022-33942\",\"sourceIdentifier\":\"secure@intel.com\",\"published\":\"2022-11-11T16:15:15.097\",\"lastModified\":\"2025-02-05T21:15:18.953\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Protection mechanism failure in the Intel(R) DCM software before version 5.0 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.\"},{\"lang\":\"es\",\"value\":\"La falla del mecanismo de protecci\u00f3n en el software Intel(R) DCM anterior a la versi\u00f3n 5.0 puede permitir que un usuario no autenticado habilite potencialmente la escalada de privilegios a trav\u00e9s del acceso adyacente.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secure@intel.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.1,\"impactScore\":6.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-693\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:intel:data_center_manager:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.0\",\"matchCriteriaId\":\"17F290FC-EC2A-4E64-9E66-5BC9857E55ED\"}]}]}],\"references\":[{\"url\":\"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00713.html\",\"source\":\"secure@intel.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00713.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00713.html\", \"name\": \"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00713.html\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T08:16:15.935Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-33942\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-01-29T20:41:27.267713Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-693\", \"description\": \"CWE-693 Protection Mechanism Failure\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-01-29T20:41:28.716Z\"}}], \"cna\": {\"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"n/a\", \"product\": \"Intel(R) DCM software\", \"versions\": [{\"status\": \"affected\", \"version\": \"before version 5.0\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00713.html\", \"name\": \"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00713.html\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Protection mechanism failure in the Intel(R) DCM software before version 5.0 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"description\": \"escalation of privilege\"}]}], \"providerMetadata\": {\"orgId\": \"6dda929c-bb53-4a77-a76d-48e79601a1ce\", \"shortName\": \"intel\", \"dateUpdated\": \"2022-11-14T17:46:08.833Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2022-33942\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-02-05T20:52:11.139Z\", \"dateReserved\": \"2022-06-17T20:54:11.143Z\", \"assignerOrgId\": \"6dda929c-bb53-4a77-a76d-48e79601a1ce\", \"datePublished\": \"2022-11-11T15:48:43.742Z\", \"requesterUserId\": \"e1538295-92a9-4bd5-bb63-88a76fc3a35c\", \"assignerShortName\": \"intel\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
CERTFR-2022-AVI-1009
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Intel. Elles permettent à un attaquant de provoquer un déni de service, une atteinte à la confidentialité des données et une élévation de privilèges.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Intel | N/A | Intel MC versions antérieures à 2.3.2 | ||
| Intel | N/A | Intel EMA versions antérieures à 1.7.1 | ||
| Intel | N/A | Intel Quartus Prime Pro edition software versions antérieures à 22.1 | ||
| Intel | N/A | Intel CSME versions antérieures à 11.8.93, 11.22.93, 11.12.93, 12.0.92, 14.1.67, 15.0.42, 16.1.25 | ||
| Intel | N/A | Intel PROSet/Wireless WiFi UEFI drivers versions antérieures à 2.2.14.22176 | ||
| Intel | N/A | Intel SPS versions antérieures à SPS_E3_04.01.04.700.0, SPS_E3_06.00.03.035.0 | ||
| Intel | N/A | Intel SDP Tool versions antérieures à 3.0.0 | ||
| Intel | N/A | Intel NUC HDMI Firmware Update Tool pour NUC7i3DN, NUC7i5DN et NUC7i7DN versions antérieures à 1.78.2.0.7. | ||
| Intel | N/A | Intel Advanced Link Analyzer Pro versions antérieures à 22.2 | ||
| Intel | N/A | PresentMon versions antérieures à 1.7.1 | ||
| Intel | N/A | Intel NUC Kit Wireless Adapter driver installer software versions antérieures à 22.40.0 | ||
| Intel | N/A | Intel SGX SDK software pour Linux versions antérieures à 2.18.100.1 | ||
| Intel | N/A | Intel Glorp gaming particle physics demonstration software version 1.0.0 | ||
| Intel | N/A | Les produits Intel vPRO CSME WiFi sans la dernière mise à jour | ||
| Intel | N/A | Intel Advanced Link Analyzer Standrad versions antérieures à 22.1.1 STD | ||
| Intel | N/A | Intel XMM 7560 Modem M.2 sans la dernière mise à jour | ||
| Intel | N/A | Intel Server System R1000WF, R200WF et Intel Server Board S2600WF sans la dernière mise à jour | ||
| Intel | N/A | Intel EMA versions antérieures à 1.8.0 | ||
| Intel | N/A | Intel Server Board M50CYP sans la dernière mise à jour | ||
| Intel | N/A | Intel PROSet/Wireless WiFi versions antérieures à 22.140 | ||
| Intel | N/A | Intel Processors sans la dernière mise à jour | ||
| Intel | N/A | Intel VTune Profiler software versions antérieures à 2022.2.0 | ||
| Intel | N/A | Intel NUC BIOS Firmware sans la dernière mise à jour | ||
| Intel | N/A | Intel Quartus Prime Standard edition software versions antérieures à 21.1 Patch 0.02std | ||
| Intel | N/A | Intel Server Board M10JNP sans la dernière mise à jour | ||
| Intel | N/A | Intel AMT versions antérieures à 11.8.93, 11.22.93, 12.0.92, 14.1.67, 15.0.42, 16.0 | ||
| Intel | N/A | Killer WiFi versions antérieures à 3.1122.3158 | ||
| Intel | N/A | Intel Distribution of OpenVINO Toolkit versions antérieures à 2021.4.2 | ||
| Intel | N/A | Intel SGX SDK software pour Windows versions antérieures à 2.17.100.1 | ||
| Intel | N/A | Intel AMT SDK versions antérieures à 16.0.4.1 | ||
| Intel | N/A | Hyperscan library versions antérieures à 5.4.0 | ||
| Intel | N/A | Intel System Studio toutes versions | ||
| Intel | N/A | Intel WAPI Security sans la dernière mise à jour | ||
| Intel | N/A | Intel DCM versions antérieures à 5.0 | ||
| Intel | N/A | Intel Support Android application versions antérieures à 22.02.28 |
References
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Intel MC versions ant\u00e9rieures \u00e0 2.3.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel EMA versions ant\u00e9rieures \u00e0 1.7.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel Quartus Prime Pro edition software versions ant\u00e9rieures \u00e0 22.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel CSME versions ant\u00e9rieures \u00e0 11.8.93, 11.22.93, 11.12.93, 12.0.92, 14.1.67, 15.0.42, 16.1.25",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel PROSet/Wireless WiFi UEFI drivers versions ant\u00e9rieures \u00e0 2.2.14.22176",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel SPS versions ant\u00e9rieures \u00e0 SPS_E3_04.01.04.700.0, SPS_E3_06.00.03.035.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel SDP Tool versions ant\u00e9rieures \u00e0 3.0.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel NUC HDMI Firmware Update Tool pour NUC7i3DN, NUC7i5DN et NUC7i7DN versions ant\u00e9rieures \u00e0 1.78.2.0.7.",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel Advanced Link Analyzer Pro versions ant\u00e9rieures \u00e0 22.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "PresentMon versions ant\u00e9rieures \u00e0 1.7.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel NUC Kit Wireless Adapter driver installer software versions ant\u00e9rieures \u00e0 22.40.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel SGX SDK software pour Linux versions ant\u00e9rieures \u00e0 2.18.100.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel Glorp gaming particle physics demonstration software version 1.0.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Les produits Intel vPRO CSME WiFi sans la derni\u00e8re mise \u00e0 jour",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel Advanced Link Analyzer Standrad versions ant\u00e9rieures \u00e0 22.1.1 STD",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel XMM 7560 Modem M.2 sans la derni\u00e8re mise \u00e0 jour",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel Server System R1000WF, R200WF et Intel Server Board S2600WF sans la derni\u00e8re mise \u00e0 jour",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel EMA versions ant\u00e9rieures \u00e0 1.8.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel Server Board M50CYP sans la derni\u00e8re mise \u00e0 jour",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel PROSet/Wireless WiFi versions ant\u00e9rieures \u00e0 22.140",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel Processors sans la derni\u00e8re mise \u00e0 jour",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel VTune Profiler software versions ant\u00e9rieures \u00e0 2022.2.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel NUC BIOS Firmware sans la derni\u00e8re mise \u00e0 jour",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel Quartus Prime Standard edition software versions ant\u00e9rieures \u00e0 21.1 Patch 0.02std",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel Server Board M10JNP sans la derni\u00e8re mise \u00e0 jour",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel AMT versions ant\u00e9rieures \u00e0 11.8.93, 11.22.93, 12.0.92, 14.1.67, 15.0.42, 16.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Killer WiFi versions ant\u00e9rieures \u00e0 3.1122.3158",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel Distribution of OpenVINO Toolkit versions ant\u00e9rieures \u00e0 2021.4.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel SGX SDK software pour Windows versions ant\u00e9rieures \u00e0 2.17.100.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel AMT SDK versions ant\u00e9rieures \u00e0 16.0.4.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Hyperscan library versions ant\u00e9rieures \u00e0 5.4.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel System Studio toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel WAPI Security sans la derni\u00e8re mise \u00e0 jour",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel DCM versions ant\u00e9rieures \u00e0 5.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel Support Android application versions ant\u00e9rieures \u00e0 22.02.28",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-27233",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27233"
},
{
"name": "CVE-2022-27874",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27874"
},
{
"name": "CVE-2022-36789",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-36789"
},
{
"name": "CVE-2022-36380",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-36380"
},
{
"name": "CVE-2022-33942",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-33942"
},
{
"name": "CVE-2022-37334",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-37334"
},
{
"name": "CVE-2022-36349",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-36349"
},
{
"name": "CVE-2022-38099",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-38099"
},
{
"name": "CVE-2022-27187",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27187"
},
{
"name": "CVE-2022-30548",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30548"
},
{
"name": "CVE-2022-26513",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26513"
},
{
"name": "CVE-2022-27497",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27497"
},
{
"name": "CVE-2021-0185",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0185"
},
{
"name": "CVE-2021-33064",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-33064"
},
{
"name": "CVE-2022-21198",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-21198"
},
{
"name": "CVE-2022-30691",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30691"
},
{
"name": "CVE-2022-36384",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-36384"
},
{
"name": "CVE-2022-26028",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26028"
},
{
"name": "CVE-2022-32569",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32569"
},
{
"name": "CVE-2022-25917",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-25917"
},
{
"name": "CVE-2022-26086",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26086"
},
{
"name": "CVE-2022-28126",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28126"
},
{
"name": "CVE-2022-34152",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-34152"
},
{
"name": "CVE-2022-26341",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26341"
},
{
"name": "CVE-2022-26367",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26367"
},
{
"name": "CVE-2022-26006",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26006"
},
{
"name": "CVE-2022-21794",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-21794"
},
{
"name": "CVE-2022-26508",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26508"
},
{
"name": "CVE-2022-33176",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-33176"
},
{
"name": "CVE-2022-26369",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26369"
},
{
"name": "CVE-2022-33973",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-33973"
},
{
"name": "CVE-2022-26845",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26845"
},
{
"name": "CVE-2021-33164",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-33164"
},
{
"name": "CVE-2021-33159",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-33159"
},
{
"name": "CVE-2022-37345",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-37345"
},
{
"name": "CVE-2022-27638",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27638"
},
{
"name": "CVE-2022-36367",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-36367"
},
{
"name": "CVE-2022-36370",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-36370"
},
{
"name": "CVE-2022-26045",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26045"
},
{
"name": "CVE-2022-26124",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26124"
},
{
"name": "CVE-2022-36400",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-36400"
},
{
"name": "CVE-2022-28611",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28611"
},
{
"name": "CVE-2022-35276",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35276"
},
{
"name": "CVE-2022-36377",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-36377"
},
{
"name": "CVE-2022-28667",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28667"
},
{
"name": "CVE-2022-26079",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26079"
},
{
"name": "CVE-2021-26251",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-26251"
},
{
"name": "CVE-2022-29486",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29486"
},
{
"name": "CVE-2022-26047",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26047"
},
{
"name": "CVE-2022-27639",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27639"
},
{
"name": "CVE-2022-29515",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29515"
},
{
"name": "CVE-2022-29893",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29893"
},
{
"name": "CVE-2022-27499",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27499"
},
{
"name": "CVE-2022-30297",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30297"
},
{
"name": "CVE-2022-30542",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30542"
},
{
"name": "CVE-2022-29466",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29466"
},
{
"name": "CVE-2022-26024",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26024"
}
],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00676 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00676.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00715 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00715.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00687 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00687.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00691 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00691.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00695 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00695.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00713 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00713.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00558 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00558.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00711 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00711.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00720 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00720.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00642 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00642.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00716 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00716.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00747 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00747.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00680 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00680.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00699 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00699.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00659 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00659.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00683 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00683.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00708 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00708.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00688 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00688.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00710 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00710.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00689 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00689.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00673 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00673.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00740 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00740.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00610 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00610.html"
}
],
"reference": "CERTFR-2022-AVI-1009",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-11-09T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Intel.\nElles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service, une\natteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une \u00e9l\u00e9vation de\nprivil\u00e8ges.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Intel",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00752 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00752.html"
}
]
}
CERTFR-2022-AVI-1009
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été découvertes dans les produits Intel. Elles permettent à un attaquant de provoquer un déni de service, une atteinte à la confidentialité des données et une élévation de privilèges.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Intel | N/A | Intel MC versions antérieures à 2.3.2 | ||
| Intel | N/A | Intel EMA versions antérieures à 1.7.1 | ||
| Intel | N/A | Intel Quartus Prime Pro edition software versions antérieures à 22.1 | ||
| Intel | N/A | Intel CSME versions antérieures à 11.8.93, 11.22.93, 11.12.93, 12.0.92, 14.1.67, 15.0.42, 16.1.25 | ||
| Intel | N/A | Intel PROSet/Wireless WiFi UEFI drivers versions antérieures à 2.2.14.22176 | ||
| Intel | N/A | Intel SPS versions antérieures à SPS_E3_04.01.04.700.0, SPS_E3_06.00.03.035.0 | ||
| Intel | N/A | Intel SDP Tool versions antérieures à 3.0.0 | ||
| Intel | N/A | Intel NUC HDMI Firmware Update Tool pour NUC7i3DN, NUC7i5DN et NUC7i7DN versions antérieures à 1.78.2.0.7. | ||
| Intel | N/A | Intel Advanced Link Analyzer Pro versions antérieures à 22.2 | ||
| Intel | N/A | PresentMon versions antérieures à 1.7.1 | ||
| Intel | N/A | Intel NUC Kit Wireless Adapter driver installer software versions antérieures à 22.40.0 | ||
| Intel | N/A | Intel SGX SDK software pour Linux versions antérieures à 2.18.100.1 | ||
| Intel | N/A | Intel Glorp gaming particle physics demonstration software version 1.0.0 | ||
| Intel | N/A | Les produits Intel vPRO CSME WiFi sans la dernière mise à jour | ||
| Intel | N/A | Intel Advanced Link Analyzer Standrad versions antérieures à 22.1.1 STD | ||
| Intel | N/A | Intel XMM 7560 Modem M.2 sans la dernière mise à jour | ||
| Intel | N/A | Intel Server System R1000WF, R200WF et Intel Server Board S2600WF sans la dernière mise à jour | ||
| Intel | N/A | Intel EMA versions antérieures à 1.8.0 | ||
| Intel | N/A | Intel Server Board M50CYP sans la dernière mise à jour | ||
| Intel | N/A | Intel PROSet/Wireless WiFi versions antérieures à 22.140 | ||
| Intel | N/A | Intel Processors sans la dernière mise à jour | ||
| Intel | N/A | Intel VTune Profiler software versions antérieures à 2022.2.0 | ||
| Intel | N/A | Intel NUC BIOS Firmware sans la dernière mise à jour | ||
| Intel | N/A | Intel Quartus Prime Standard edition software versions antérieures à 21.1 Patch 0.02std | ||
| Intel | N/A | Intel Server Board M10JNP sans la dernière mise à jour | ||
| Intel | N/A | Intel AMT versions antérieures à 11.8.93, 11.22.93, 12.0.92, 14.1.67, 15.0.42, 16.0 | ||
| Intel | N/A | Killer WiFi versions antérieures à 3.1122.3158 | ||
| Intel | N/A | Intel Distribution of OpenVINO Toolkit versions antérieures à 2021.4.2 | ||
| Intel | N/A | Intel SGX SDK software pour Windows versions antérieures à 2.17.100.1 | ||
| Intel | N/A | Intel AMT SDK versions antérieures à 16.0.4.1 | ||
| Intel | N/A | Hyperscan library versions antérieures à 5.4.0 | ||
| Intel | N/A | Intel System Studio toutes versions | ||
| Intel | N/A | Intel WAPI Security sans la dernière mise à jour | ||
| Intel | N/A | Intel DCM versions antérieures à 5.0 | ||
| Intel | N/A | Intel Support Android application versions antérieures à 22.02.28 |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Intel MC versions ant\u00e9rieures \u00e0 2.3.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel EMA versions ant\u00e9rieures \u00e0 1.7.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel Quartus Prime Pro edition software versions ant\u00e9rieures \u00e0 22.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel CSME versions ant\u00e9rieures \u00e0 11.8.93, 11.22.93, 11.12.93, 12.0.92, 14.1.67, 15.0.42, 16.1.25",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel PROSet/Wireless WiFi UEFI drivers versions ant\u00e9rieures \u00e0 2.2.14.22176",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel SPS versions ant\u00e9rieures \u00e0 SPS_E3_04.01.04.700.0, SPS_E3_06.00.03.035.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel SDP Tool versions ant\u00e9rieures \u00e0 3.0.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel NUC HDMI Firmware Update Tool pour NUC7i3DN, NUC7i5DN et NUC7i7DN versions ant\u00e9rieures \u00e0 1.78.2.0.7.",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel Advanced Link Analyzer Pro versions ant\u00e9rieures \u00e0 22.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "PresentMon versions ant\u00e9rieures \u00e0 1.7.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel NUC Kit Wireless Adapter driver installer software versions ant\u00e9rieures \u00e0 22.40.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel SGX SDK software pour Linux versions ant\u00e9rieures \u00e0 2.18.100.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel Glorp gaming particle physics demonstration software version 1.0.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Les produits Intel vPRO CSME WiFi sans la derni\u00e8re mise \u00e0 jour",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel Advanced Link Analyzer Standrad versions ant\u00e9rieures \u00e0 22.1.1 STD",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel XMM 7560 Modem M.2 sans la derni\u00e8re mise \u00e0 jour",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel Server System R1000WF, R200WF et Intel Server Board S2600WF sans la derni\u00e8re mise \u00e0 jour",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel EMA versions ant\u00e9rieures \u00e0 1.8.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel Server Board M50CYP sans la derni\u00e8re mise \u00e0 jour",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel PROSet/Wireless WiFi versions ant\u00e9rieures \u00e0 22.140",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel Processors sans la derni\u00e8re mise \u00e0 jour",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel VTune Profiler software versions ant\u00e9rieures \u00e0 2022.2.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel NUC BIOS Firmware sans la derni\u00e8re mise \u00e0 jour",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel Quartus Prime Standard edition software versions ant\u00e9rieures \u00e0 21.1 Patch 0.02std",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel Server Board M10JNP sans la derni\u00e8re mise \u00e0 jour",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel AMT versions ant\u00e9rieures \u00e0 11.8.93, 11.22.93, 12.0.92, 14.1.67, 15.0.42, 16.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Killer WiFi versions ant\u00e9rieures \u00e0 3.1122.3158",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel Distribution of OpenVINO Toolkit versions ant\u00e9rieures \u00e0 2021.4.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel SGX SDK software pour Windows versions ant\u00e9rieures \u00e0 2.17.100.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel AMT SDK versions ant\u00e9rieures \u00e0 16.0.4.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Hyperscan library versions ant\u00e9rieures \u00e0 5.4.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel System Studio toutes versions",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel WAPI Security sans la derni\u00e8re mise \u00e0 jour",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel DCM versions ant\u00e9rieures \u00e0 5.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
},
{
"description": "Intel Support Android application versions ant\u00e9rieures \u00e0 22.02.28",
"product": {
"name": "N/A",
"vendor": {
"name": "Intel",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-27233",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27233"
},
{
"name": "CVE-2022-27874",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27874"
},
{
"name": "CVE-2022-36789",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-36789"
},
{
"name": "CVE-2022-36380",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-36380"
},
{
"name": "CVE-2022-33942",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-33942"
},
{
"name": "CVE-2022-37334",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-37334"
},
{
"name": "CVE-2022-36349",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-36349"
},
{
"name": "CVE-2022-38099",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-38099"
},
{
"name": "CVE-2022-27187",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27187"
},
{
"name": "CVE-2022-30548",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30548"
},
{
"name": "CVE-2022-26513",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26513"
},
{
"name": "CVE-2022-27497",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27497"
},
{
"name": "CVE-2021-0185",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-0185"
},
{
"name": "CVE-2021-33064",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-33064"
},
{
"name": "CVE-2022-21198",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-21198"
},
{
"name": "CVE-2022-30691",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30691"
},
{
"name": "CVE-2022-36384",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-36384"
},
{
"name": "CVE-2022-26028",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26028"
},
{
"name": "CVE-2022-32569",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-32569"
},
{
"name": "CVE-2022-25917",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-25917"
},
{
"name": "CVE-2022-26086",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26086"
},
{
"name": "CVE-2022-28126",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28126"
},
{
"name": "CVE-2022-34152",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-34152"
},
{
"name": "CVE-2022-26341",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26341"
},
{
"name": "CVE-2022-26367",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26367"
},
{
"name": "CVE-2022-26006",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26006"
},
{
"name": "CVE-2022-21794",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-21794"
},
{
"name": "CVE-2022-26508",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26508"
},
{
"name": "CVE-2022-33176",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-33176"
},
{
"name": "CVE-2022-26369",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26369"
},
{
"name": "CVE-2022-33973",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-33973"
},
{
"name": "CVE-2022-26845",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26845"
},
{
"name": "CVE-2021-33164",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-33164"
},
{
"name": "CVE-2021-33159",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-33159"
},
{
"name": "CVE-2022-37345",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-37345"
},
{
"name": "CVE-2022-27638",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27638"
},
{
"name": "CVE-2022-36367",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-36367"
},
{
"name": "CVE-2022-36370",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-36370"
},
{
"name": "CVE-2022-26045",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26045"
},
{
"name": "CVE-2022-26124",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26124"
},
{
"name": "CVE-2022-36400",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-36400"
},
{
"name": "CVE-2022-28611",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28611"
},
{
"name": "CVE-2022-35276",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-35276"
},
{
"name": "CVE-2022-36377",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-36377"
},
{
"name": "CVE-2022-28667",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-28667"
},
{
"name": "CVE-2022-26079",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26079"
},
{
"name": "CVE-2021-26251",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-26251"
},
{
"name": "CVE-2022-29486",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29486"
},
{
"name": "CVE-2022-26047",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26047"
},
{
"name": "CVE-2022-27639",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27639"
},
{
"name": "CVE-2022-29515",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29515"
},
{
"name": "CVE-2022-29893",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29893"
},
{
"name": "CVE-2022-27499",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-27499"
},
{
"name": "CVE-2022-30297",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30297"
},
{
"name": "CVE-2022-30542",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30542"
},
{
"name": "CVE-2022-29466",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29466"
},
{
"name": "CVE-2022-26024",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-26024"
}
],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00676 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00676.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00715 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00715.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00687 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00687.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00691 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00691.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00695 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00695.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00713 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00713.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00558 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00558.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00711 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00711.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00720 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00720.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00642 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00642.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00716 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00716.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00747 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00747.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00680 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00680.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00699 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00699.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00659 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00659.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00683 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00683.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00708 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00708.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00688 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00688.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00710 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00710.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00689 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00689.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00673 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00673.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00740 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00740.html"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00610 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00610.html"
}
],
"reference": "CERTFR-2022-AVI-1009",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-11-09T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Intel.\nElles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service, une\natteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une \u00e9l\u00e9vation de\nprivil\u00e8ges.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Intel",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Intel intel-sa-00752 du 08 novembre 2022",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00752.html"
}
]
}
FKIE_CVE-2022-33942
Vulnerability from fkie_nvd - Published: 2022-11-11 16:15 - Updated: 2025-02-05 21:15
Severity ?
8.8 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
8.8 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Protection mechanism failure in the Intel(R) DCM software before version 5.0 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| intel | data_center_manager | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:intel:data_center_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "17F290FC-EC2A-4E64-9E66-5BC9857E55ED",
"versionEndExcluding": "5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Protection mechanism failure in the Intel(R) DCM software before version 5.0 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access."
},
{
"lang": "es",
"value": "La falla del mecanismo de protecci\u00f3n en el software Intel(R) DCM anterior a la versi\u00f3n 5.0 puede permitir que un usuario no autenticado habilite potencialmente la escalada de privilegios a trav\u00e9s del acceso adyacente."
}
],
"id": "CVE-2022-33942",
"lastModified": "2025-02-05T21:15:18.953",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.1,
"impactScore": 6.0,
"source": "secure@intel.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-11-11T16:15:15.097",
"references": [
{
"source": "secure@intel.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00713.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00713.html"
}
],
"sourceIdentifier": "secure@intel.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-693"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
GHSA-PH96-X94X-WG4H
Vulnerability from github – Published: 2022-11-11 19:00 – Updated: 2022-11-17 15:30
VLAI?
Details
Protection mechanism failure in the Intel(R) DCM software before version 5.0 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
Severity ?
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2022-33942"
],
"database_specific": {
"cwe_ids": [
"CWE-693"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-11T16:15:00Z",
"severity": "HIGH"
},
"details": "Protection mechanism failure in the Intel(R) DCM software before version 5.0 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.",
"id": "GHSA-ph96-x94x-wg4h",
"modified": "2022-11-17T15:30:21Z",
"published": "2022-11-11T19:00:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-33942"
},
{
"type": "WEB",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00713.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
VAR-202211-0866
Vulnerability from variot - Updated: 2023-12-18 12:48Protection mechanism failure in the Intel(R) DCM software before version 5.0 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access. RCE Security Advisory https://www.rcesecurity.com
1. ADVISORY INFORMATION
Product: Intel Data Center Manager Vendor URL: https://www.intel.com/content/www/us/en/developer/tools/data-center-manager-console/overview.html Type: Authentication Bypass by Spoofing [CWE-290] Date found: 2022-06-01 Date published: 2022-11-23 CVSSv3 Score: 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) CVE: CVE-2022-33942
2. CREDITS
This vulnerability was discovered and researched by Julien Ahrens from RCE Security.
3. VERSIONS AFFECTED
Intel Data Center Manager 4.1.1.45749 and below
4. INTRODUCTION
Energy costs are the fastest rising expense for today’s data centers. Intel® Data Center Manager (Intel® DCM) provides real-time power and thermal consumption data, giving you the clarity you need to lower power usage, increase rack density, and prolong operation during outages.
(from the vendor's homepage)
5. VULNERABILITY DETAILS
The application allows configuring authentication via Active Directory groups. While this by itself isn't an issue, it becomes one as soon as an Active Directory group with a well-known SID (such as "S-1-5-32-544" or "S-1-5-32-546") is configured to allow authentication to DCM. This is because Intel's DCM only relies on the group's SID to allow authentication but doesn't verify the authenticating domain, which the user can give during the authentication process against the DCM Console and its REST interface.
Since the DCM will send all Kerberos and LDAP (authentication) requests against the given domain, it is trivially easy to spoof the authentication responses by using an arbitrary Kerberos and LDAP server and replying with the SID of one of the configured Active Directory groups.
This allows an attacker to bypass the authentication schema by using any domain with any user/password combination without actually being part of any Active Directory groups.
6. PROOF OF CONCEPT
See the referenced blog post for a full exploit.
7. SOLUTION
Update to Intel DCM 5.0 or later
8. REPORT TIMELINE
2022-06-01: Discovery of the vulnerability 2022-06-28: Sent notification to Intel via their PSIRT 2022-06-28: Vendor response: Sent to appropriate reviewers. 2022-06-29: Vendor acknowledges the vulnerability and asks for coordinated disclosure on Nov. 8, 2022 2022-06-30: Rejected the disclosure date, due to my own policy, which makes it: August 13, 2022 2022-07-08: After a vendor call, I've submitted the issue through Intel's bug bounty program 2022-xx-xx: Vendor releases version 5.0 without any notification which fixes this vulnerability 2022-11-08: Vendor (responsible CNA) assigns CVE-2022-33942 2022-11-08: Vendor publishes security advisory INTEL-SA-00713 2022-11-23: Public disclosure
9. REFERENCES
https://www.rcesecurity.com/2022/11/from-zero-to-hero-part-1-bypassing-intel-dcms-authentication-by-spoofing-kerberos-and-ldap-responses-cve-2022-33942 https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00713.html https://github.com/MrTuxracer/advisories
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202211-0866",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "data center manager",
"scope": "lt",
"trust": 1.0,
"vendor": "intel",
"version": "5.0"
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2022-33942"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:intel:data_center_manager:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "5.0",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2022-33942"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Julien Ahrens",
"sources": [
{
"db": "PACKETSTORM",
"id": "170065"
},
{
"db": "CNNVD",
"id": "CNNVD-202211-2595"
}
],
"trust": 0.7
},
"cve": "CVE-2022-33942",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"author": "secure@intel.com",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.1,
"impactScore": 6.0,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2022-33942",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "secure@intel.com",
"id": "CVE-2022-33942",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-202211-2595",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2022-33942"
},
{
"db": "NVD",
"id": "CVE-2022-33942"
},
{
"db": "CNNVD",
"id": "CNNVD-202211-2595"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Protection mechanism failure in the Intel(R) DCM software before version 5.0 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access. RCE Security Advisory\nhttps://www.rcesecurity.com\n\n\n1. ADVISORY INFORMATION\n=======================\nProduct: Intel Data Center Manager\nVendor URL: https://www.intel.com/content/www/us/en/developer/tools/data-center-manager-console/overview.html\nType: Authentication Bypass by Spoofing [CWE-290]\nDate found: 2022-06-01\nDate published: 2022-11-23\nCVSSv3 Score: 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)\nCVE: CVE-2022-33942\n\n\n2. CREDITS\n==========\nThis vulnerability was discovered and researched by Julien Ahrens from\nRCE Security. \n\n\n3. VERSIONS AFFECTED\n====================\nIntel Data Center Manager 4.1.1.45749 and below\n\n\n4. INTRODUCTION\n===============\nEnergy costs are the fastest rising expense for today\u2019s data centers. Intel\u00ae Data\nCenter Manager (Intel\u00ae DCM) provides real-time power and thermal consumption data,\ngiving you the clarity you need to lower power usage, increase rack density, and\nprolong operation during outages. \n\n(from the vendor\u0027s homepage)\n\n\n5. VULNERABILITY DETAILS\n========================\nThe application allows configuring authentication via Active Directory groups. While\nthis by itself isn\u0027t an issue, it becomes one as soon as an Active Directory group\nwith a well-known SID (such as \"S-1-5-32-544\" or \"S-1-5-32-546\") is configured to\nallow authentication to DCM. This is because Intel\u0027s DCM only relies on the group\u0027s\nSID to allow authentication but doesn\u0027t verify the authenticating domain, which the\nuser can give during the authentication process against the DCM Console and its REST\ninterface. \n\nSince the DCM will send all Kerberos and LDAP (authentication) requests against the\ngiven domain, it is trivially easy to spoof the authentication responses by using an\narbitrary Kerberos and LDAP server and replying with the SID of one of the configured\nActive Directory groups. \n\nThis allows an attacker to bypass the authentication schema by using any domain\nwith any user/password combination without actually being part of any Active Directory\ngroups. \n\n\n6. PROOF OF CONCEPT\n===================\nSee the referenced blog post for a full exploit. \n\n\n7. SOLUTION\n===========\nUpdate to Intel DCM 5.0 or later\n\n\n8. REPORT TIMELINE\n==================\n2022-06-01: Discovery of the vulnerability\n2022-06-28: Sent notification to Intel via their PSIRT\n2022-06-28: Vendor response: Sent to appropriate reviewers. \n2022-06-29: Vendor acknowledges the vulnerability and asks for coordinated disclosure on Nov. 8, 2022\n2022-06-30: Rejected the disclosure date, due to my own policy, which makes it: August 13, 2022\n2022-07-08: After a vendor call, I\u0027ve submitted the issue through Intel\u0027s bug bounty program\n2022-xx-xx: Vendor releases version 5.0 without any notification which fixes this vulnerability\n2022-11-08: Vendor (responsible CNA) assigns CVE-2022-33942\n2022-11-08: Vendor publishes security advisory INTEL-SA-00713\n2022-11-23: Public disclosure\n\n\n9. REFERENCES\n=============\nhttps://www.rcesecurity.com/2022/11/from-zero-to-hero-part-1-bypassing-intel-dcms-authentication-by-spoofing-kerberos-and-ldap-responses-cve-2022-33942\nhttps://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00713.html\nhttps://github.com/MrTuxracer/advisories\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2022-33942"
},
{
"db": "VULHUB",
"id": "VHN-426130"
},
{
"db": "PACKETSTORM",
"id": "170065"
}
],
"trust": 1.08
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-426130",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-426130"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2022-33942",
"trust": 1.8
},
{
"db": "PACKETSTORM",
"id": "170065",
"trust": 0.8
},
{
"db": "AUSCERT",
"id": "ESB-2022.5843.2",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2022.5843",
"trust": 0.6
},
{
"db": "CXSECURITY",
"id": "WLB-2022120005",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202211-2595",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-426130",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-426130"
},
{
"db": "PACKETSTORM",
"id": "170065"
},
{
"db": "NVD",
"id": "CVE-2022-33942"
},
{
"db": "CNNVD",
"id": "CNNVD-202211-2595"
}
]
},
"id": "VAR-202211-0866",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-426130"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:48:24.329000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Intel Data Center Manager Security vulnerabilities",
"trust": 0.6,
"url": "http://123.124.177.30/web/xxk/bdxqbyid.tag?id=214643"
}
],
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202211-2595"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2022-33942"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.8,
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00713.html"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/issue/wlb-2022120005"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/170065/intel-data-center-manager-4.1.1.45749-authentication-bypass-spoofing.html"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2022.5843"
},
{
"trust": 0.6,
"url": "https://cxsecurity.com/cveshow/cve-2022-33942/"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2022.5843.2"
},
{
"trust": 0.1,
"url": "https://github.com/mrtuxracer/advisories"
},
{
"trust": 0.1,
"url": "https://www.intel.com/content/www/us/en/developer/tools/data-center-manager-console/overview.html"
},
{
"trust": 0.1,
"url": "https://www.rcesecurity.com/2022/11/from-zero-to-hero-part-1-bypassing-intel-dcms-authentication-by-spoofing-kerberos-and-ldap-responses-cve-2022-33942"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2022-33942"
},
{
"trust": 0.1,
"url": "https://www.rcesecurity.com"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-426130"
},
{
"db": "PACKETSTORM",
"id": "170065"
},
{
"db": "NVD",
"id": "CVE-2022-33942"
},
{
"db": "CNNVD",
"id": "CNNVD-202211-2595"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-426130"
},
{
"db": "PACKETSTORM",
"id": "170065"
},
{
"db": "NVD",
"id": "CVE-2022-33942"
},
{
"db": "CNNVD",
"id": "CNNVD-202211-2595"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-11-11T00:00:00",
"db": "VULHUB",
"id": "VHN-426130"
},
{
"date": "2022-11-30T20:48:27",
"db": "PACKETSTORM",
"id": "170065"
},
{
"date": "2022-11-11T16:15:15.097000",
"db": "NVD",
"id": "CVE-2022-33942"
},
{
"date": "2022-11-11T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202211-2595"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2022-11-17T00:00:00",
"db": "VULHUB",
"id": "VHN-426130"
},
{
"date": "2022-11-17T15:01:31.323000",
"db": "NVD",
"id": "CVE-2022-33942"
},
{
"date": "2023-03-28T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202211-2595"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote or local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202211-2595"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Intel Data Center Manager Security hole",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202211-2595"
}
],
"trust": 0.6
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "other",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202211-2595"
}
],
"trust": 0.6
}
}
GSD-2022-33942
Vulnerability from gsd - Updated: 2023-12-13 01:19Details
Protection mechanism failure in the Intel(R) DCM software before version 5.0 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2022-33942",
"description": "Protection mechanism failure in the Intel(R) DCM software before version 5.0 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.",
"id": "GSD-2022-33942"
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2022-33942"
],
"details": "Protection mechanism failure in the Intel(R) DCM software before version 5.0 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.",
"id": "GSD-2022-33942",
"modified": "2023-12-13T01:19:24.227628Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "secure@intel.com",
"ID": "CVE-2022-33942",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Intel(R) DCM software",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "before version 5.0"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Protection mechanism failure in the Intel(R) DCM software before version 5.0 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access."
}
]
},
"impact": {
"cvss": [
{
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "escalation of privilege"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00713.html",
"refsource": "MISC",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00713.html"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:intel:data_center_manager:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "5.0",
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "secure@intel.com",
"ID": "CVE-2022-33942"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "Protection mechanism failure in the Intel(R) DCM software before version 5.0 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00713.html",
"refsource": "MISC",
"tags": [
"Vendor Advisory"
],
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00713.html"
}
]
}
},
"impact": {
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9
}
},
"lastModifiedDate": "2022-11-17T15:01Z",
"publishedDate": "2022-11-11T16:15Z"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…