CVE-2022-3368 - Software Updater of Avira Security for Windows vulnerable to Privilege Escalation

Back Back to CVE browser

HIGH

Software Updater of Avira Security for Windows vulnerable to Privilege Escalation

Published Oct 17, 2022

8.8

HIGH

CVSS 3.1

EPSS 0.90%

Description

A vulnerability within the Software Updater functionality of Avira Security for Windows allowed an attacker with write access to the filesystem, to escalate his privileges in certain scenarios. The issue was fixed with Avira Security version 1.1.72.30556.

Affected products

Vendor Nortonlifelock Product n/a Default
n/a
- Version
  all
  Status
  affected
  Constraints
  <1.1.71.30554

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Nortonlifelock

n/a

Version	Status	Constraints
all	affected	<1.1.71.30554

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-276

Incorrect Default Permissions

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-42748
Advisory
https://support.norton.com/sp/static/external/tools/security-advisories.html
Vendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-42748		Advisory
https://support.norton.com/sp/static/external/tools/security-advisories.html		Vendor Advisory