CVE-2022-48188
Assigner: lenovo
Published: 2023-06-05T21:03:07.044Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: ThinkStation BIOS
vendor: Lenovo
versions: status: affected
version: various
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: Lenovo thanks River Li and Fangtao Cao for reporting this issue. 
descriptions: supportingMedia: base64: no
type: text/html
value: A buffer overflow vulnerability in the SecureBootDXE BIOS driver of some Lenovo Desktop and ThinkStation models could allow an attacker with local access to elevate their privileges to execute arbitrary code.
value: A buffer overflow vulnerability in the SecureBootDXE BIOS driver of some Lenovo Desktop and ThinkStation models could allow an attacker with local access to elevate their privileges to execute arbitrary code.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-787
description: CWE-787 Out-of-bounds Write
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: Update system firmware to the version (or newer) indicated for your model in the related Lenovo advisory:&nbsp;<a target="_blank" rel="nofollow" href="https://support.lenovo.com/us/en/product_security/LEN-124495">https://support.lenovo.com/us/en/product_security/LEN-124495</a>
value: Update system firmware to the version (or newer) indicated for your model in the related Lenovo advisory:  https://support.lenovo.com/us/en/product_security/LEN-124495 https://support.lenovo.com/us/en/product_security/LEN-124495 
source: discovery: UNKNOWN
x_generator: engine: Vulnogram 0.1.0-dev