Vulnerability · Published Nov 18, 2022 · Assigned by hp
CVE-2022-38395
High 7.8
In plain English
A high-severity uncontrolled search path in HP Support Assistant from HP Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.8% (higher than 86% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)2.8%top 13.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
HP Support Assistant uses HP Performance Tune-up as a diagnostic tool. HP Support Assistant uses Fusion to launch HP Performance Tune-up. It is possible for an attacker to exploit the DLL hijacking vulnerability and elevate privileges when Fusion launches the HP Performance Tune-up.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| HP Inc. | HP Support Assistant | See HP Security Bulletin reference for affected versions. |
Weakness: CWE-427 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H