CVE-2022-38396

HP Factory Preinstalled Images on certain systems that shipped with Windows 10 versions 20H2 and earlier OS versions might allow escalation of privilege via execution of certain files outside the restricted path. This potential vulnerability was remediated starting with Windows 10 versions 21H2 on October 31, 2021.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://support.hp.com/ie-en/document/ish_7620368-7620413-16	Vendor Advisory
https://support.hp.com/ie-en/document/ish_7620368-7620413-16	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:microsoft:windows_10_1507:-:::::::*
	cpe:2.3:o:microsoft:windows_10_1511:-:::::::*
	cpe:2.3:o:microsoft:windows_10_1607:-:::::::*
	cpe:2.3:o:microsoft:windows_10_1703:-:::::::*
	cpe:2.3:o:microsoft:windows_10_1709:-:::::::*
	cpe:2.3:o:microsoft:windows_10_1803:-:::::::*
	cpe:2.3:o:microsoft:windows_10_1809:-:::::::*
	cpe:2.3:o:microsoft:windows_10_1909:-:::::::*
	cpe:2.3:o:microsoft:windows_10_2004:-:::::::*
	cpe:2.3:o:microsoft:windows_10_20h2:-:::::::*

History

21 Nov 2024, 07:16

Type	Values Removed	Values Added
References	~~() https://support.hp.com/ie-en/document/ish_7620368-7620413-16 - Vendor Advisory~~	() https://support.hp.com/ie-en/document/ish_7620368-7620413-16 - Vendor Advisory

25 Apr 2023, 16:01

Type	Values Removed	Values Added
CPE	cpe:2.3:o:microsoft:windows_10_1807:-:::::::*

Information

Published : 2023-02-12 04:15

Updated : 2025-03-25 21:15

NVD link : CVE-2022-38396

Mitre link : CVE-2022-38396

CVE.ORG link : CVE-2022-38396

JSON object : View

Products Affected

microsoft

windows_10_1709
windows_10_1703
windows_10_1507
windows_10_1607
windows_10_20h2
windows_10_1909
windows_10_1803
windows_10_1809
windows_10_2004
windows_10_1511

CWE

NVD-CWE-noinfo

{"id": "CVE-2022-38396", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2023-02-12T04:15:14.910", "references": [{"url": "https://support.hp.com/ie-en/document/ish_7620368-7620413-16", "tags": ["Vendor Advisory"], "source": "hp-security-alert@hp.com"}, {"url": "https://support.hp.com/ie-en/document/ish_7620368-7620413-16", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "HP Factory Preinstalled Images on certain systems that shipped with Windows 10 versions 20H2 and earlier OS versions might allow escalation of privilege via execution of certain files outside the restricted path. This potential vulnerability was remediated starting with Windows 10 versions 21H2 on October 31, 2021."}], "lastModified": "2025-03-25T21:15:37.403", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "542DAEEC-73CC-46C6-A630-BF474A3446AC"}, {"criteria": "cpe:2.3:o:microsoft:windows_10_1511:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7A8E9D99-BD78-4340-88F2-5AFF27AC37C9"}, {"criteria": "cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "61019899-D7AF-46E4-A72C-D189180F66AB"}, {"criteria": "cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E1DD582C-1660-4E6E-81A1-537BD1307A99"}, {"criteria": "cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AC160B20-3EA0-49A0-A857-4E7A1C2D74E2"}, {"criteria": "cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "00345596-E9E0-4096-8DC6-0212F4747A13"}, {"criteria": "cpe:2.3:o:microsoft:windows_10_1809:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2E332666-2E03-468E-BC30-299816D6E8ED"}, {"criteria": "cpe:2.3:o:microsoft:windows_10_1909:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A1B570A8-ED1A-46B6-B8AB-064445F8FC4C"}, {"criteria": "cpe:2.3:o:microsoft:windows_10_2004:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D4DBE5B2-AE10-4251-BCDA-DC5EDEE6EE67"}, {"criteria": "cpe:2.3:o:microsoft:windows_10_20h2:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6AFD13A6-A390-4400-9029-2F4058CA17E2"}], "operator": "OR"}]}], "sourceIdentifier": "hp-security-alert@hp.com"}