Details of VAR-202302-1358

ID

VAR-202302-1358

CVE

CVE-2022-36348

TITLE

Intel (R) SPS Firmware vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2023-001421

DESCRIPTION

Active debug code in some Intel (R) SPS firmware before version SPS_E5_04.04.04.300.0 may allow an authenticated user to potentially enable escalation of privilege via local access. Intel (R) SPS There are unspecified vulnerabilities in the firmware.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state

Trust: 1.8

sources: NVD: CVE-2022-36348 // JVNDB: JVNDB-2023-001421 // VULHUB: VHN-432461 // VULMON: CVE-2022-36348

AFFECTED PRODUCTS

vendor:	intel	model:	server platform services	scope:	lt	version:	sps_e5_04.04.04.300.0	Trust: 1.0
vendor:	インテル	model:	server platform services	scope:	-	version:	-	Trust: 0.8
vendor:	日立	model:	日立アドバンストサーバ ha8000v シリーズ	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2023-001421 // NVD: CVE-2022-36348

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2022-36348
value:	HIGH
Trust: 1.0
secure@intel.com:	CVE-2022-36348
value:	HIGH
Trust: 1.0
NVD:	CVE-2022-36348
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-202302-1381
value:	HIGH
Trust: 0.6

nvd@nist.gov:	CVE-2022-36348
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.1
Trust: 1.0
secure@intel.com:	CVE-2022-36348
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.0
impactScore:	6.0
version:	3.1
Trust: 1.0
NVD:	CVE-2022-36348
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2023-001421 // CNNVD: CNNVD-202302-1381 // NVD: CVE-2022-36348 // NVD: CVE-2022-36348

PROBLEMTYPE DATA

problemtype:	NVD-CWE-Other	Trust: 1.0
problemtype:	Lack of information (CWE-noinfo) [NVD evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2023-001421 // NVD: CVE-2022-36348

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202302-1381

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202302-1381

PATCH

title:	INTEL-SA-00718 Hitachi Software Product Security Information	url:	https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00718.html	Trust: 0.8
title:	Intel SPS Security vulnerabilities	url:	http://123.124.177.30/web/xxk/bdxqById.tag?id=227778	Trust: 0.6
title:	-	url:	https://www.theregister.co.uk/2023/02/15/intel_sgx_vulns/	Trust: 0.1

sources: VULMON: CVE-2022-36348 // JVNDB: JVNDB-2023-001421 // CNNVD: CNNVD-202302-1381

EXTERNAL IDS

db:	NVD	id:	CVE-2022-36348	Trust: 3.4
db:	JVN	id:	JVNVU91223897	Trust: 0.8
db:	JVNDB	id:	JVNDB-2023-001421	Trust: 0.8
db:	CNNVD	id:	CNNVD-202302-1381	Trust: 0.6
db:	VULHUB	id:	VHN-432461	Trust: 0.1
db:	VULMON	id:	CVE-2022-36348	Trust: 0.1

sources: VULHUB: VHN-432461 // VULMON: CVE-2022-36348 // JVNDB: JVNDB-2023-001421 // CNNVD: CNNVD-202302-1381 // NVD: CVE-2022-36348

REFERENCES

url:	http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00718.html	Trust: 1.8
url:	https://jvn.jp/vu/jvnvu91223897/index.html	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2022-36348	Trust: 0.8
url:	https://cxsecurity.com/cveshow/cve-2022-36348/	Trust: 0.6
url:	https://nvd.nist.gov	Trust: 0.1
url:	https://www.theregister.co.uk/2023/02/15/intel_sgx_vulns/	Trust: 0.1

sources: VULHUB: VHN-432461 // VULMON: CVE-2022-36348 // JVNDB: JVNDB-2023-001421 // CNNVD: CNNVD-202302-1381 // NVD: CVE-2022-36348

SOURCES

db:	VULHUB	id:	VHN-432461
db:	VULMON	id:	CVE-2022-36348
db:	JVNDB	id:	JVNDB-2023-001421
db:	CNNVD	id:	CNNVD-202302-1381
db:	NVD	id:	CVE-2022-36348

LAST UPDATE DATE

2024-08-14T12:08:41.853000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-432461	date:	2023-03-06T00:00:00
db:	VULMON	id:	CVE-2022-36348	date:	2023-02-17T00:00:00
db:	JVNDB	id:	JVNDB-2023-001421	date:	2023-04-06T09:30:00
db:	CNNVD	id:	CNNVD-202302-1381	date:	2023-03-07T00:00:00
db:	NVD	id:	CVE-2022-36348	date:	2023-08-08T14:21:49.707

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-432461	date:	2023-02-16T00:00:00
db:	VULMON	id:	CVE-2022-36348	date:	2023-02-16T00:00:00
db:	JVNDB	id:	JVNDB-2023-001421	date:	2023-04-06T00:00:00
db:	CNNVD	id:	CNNVD-202302-1381	date:	2023-02-16T00:00:00
db:	NVD	id:	CVE-2022-36348	date:	2023-02-16T20:15:14.857