CVE-2022-21818

NVIDIA License System contains a vulnerability in the installation scripts for the DLS virtual appliance, where a user on a network after signing in to the portal can access other users’ credentials, allowing them to gain escalated privileges, resulting in limited impact to both confidentiality and integrity.

CVSS v3 5.4 MEDIUM
CVSS v2.0 5.5 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

5.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:N

Exploitability : 8.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://nvidia.custhelp.com/app/answers/detail/a_id/5319	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nvidia:license_system:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-02-15 00:15

Updated : 2022-02-23 18:41

NVD link : CVE-2022-21818

Mitre link : CVE-2022-21818

CVE.ORG link : CVE-2022-21818

JSON object : View

Products Affected

nvidia

license_system

CWE

CWE-312

Cleartext Storage of Sensitive Information

{"id": "CVE-2022-21818", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "psirt@nvidia.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "published": "2022-02-15T00:15:07.560", "references": [{"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5319", "tags": ["Vendor Advisory"], "source": "psirt@nvidia.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-312"}]}, {"type": "Secondary", "source": "psirt@nvidia.com", "description": [{"lang": "en", "value": "CWE-312"}]}], "descriptions": [{"lang": "en", "value": "NVIDIA License System contains a vulnerability in the installation scripts for the DLS virtual appliance, where a user on a network after signing in to the portal can access other users\u2019 credentials, allowing them to gain escalated privileges, resulting in limited impact to both confidentiality and integrity."}, {"lang": "es", "value": "NVIDIA License System contiene una vulnerabilidad en los scripts de instalaci\u00f3n del dispositivo virtual DLS, donde un usuario en una red despu\u00e9s de iniciar sesi\u00f3n en el portal puede acceder a las credenciales de otros usuarios, permiti\u00e9ndoles alcanzar privilegios escalados, resultando en un impacto limitado tanto en la confidencialidad como en la integridad"}], "lastModified": "2022-02-23T18:41:10.190", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nvidia:license_system:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7BE73D6D-E5C4-4FB4-9CB3-F0ABF91451AD", "versionEndExcluding": "1.1"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@nvidia.com"}