CVE-2015-8110

Опубликовано: 24 апр. 2017

Источник: nvd

CVSS3: 7.8

CVSS2: 7.2

EPSS Низкий

Описание

Lenovo System Update (formerly ThinkVantage System Update) before 5.07.0019 allows local users to gain privileges by navigating to (1) "Click here to learn more" or (2) "View privacy policy" within the Tvsukernel.exe GUI application in the context of a temporary administrator account, aka a "local privilege escalation vulnerability."

Ссылки

http://www.securityfocus.com/bid/98037
Third Party Advisory
VDB Entry
https://ioactive.com/pdfs/IOActive_Advisory_Lenovo_TVSUkernel-Escalation-Privileges.pdf
Exploit
Third Party Advisory
https://support.lenovo.com/us/en/product_security/lsu_privilege
Vendor Advisory
http://www.securityfocus.com/bid/98037
Third Party Advisory
VDB Entry
https://ioactive.com/pdfs/IOActive_Advisory_Lenovo_TVSUkernel-Escalation-Privileges.pdf
Exploit
Third Party Advisory
https://support.lenovo.com/us/en/product_security/lsu_privilege
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:lenovo:lenovo_system_update:*:*:*:*:*:*:*:*

Версия до 5.07.0013 (включая)

EPSS

Процентиль: 16%

0.00051

Низкий

7.8 High

CVSS3

7.2 High

CVSS2

Дефекты

CWE-264

Связанные уязвимости

GHSA-vmjj-g27m-wrq6