VulnerabilityModified
CVE-2022-43703
An installer that loads or executes files using an unconstrained search path may be vulnerable to substitute files under control of an attacker being loaded or executed instead of the intended files.
HIGH 7.8EPSS 0.19%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.19%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
An installer that loads or executes files using an unconstrained search path may be vulnerable to substitute files under control of an attacker being loaded or executed instead of the intended files.
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.19% probability · 9th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-427
- Affected
- arm/arm development studio · arm/ds development studio
- Source
- arm-security@arm.com
References
- https://developer.arm.com/documentation/ka005596/latestVendor Advisory
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00930.html
- https://developer.arm.com/documentation/ka005596/latestVendor Advisory
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00930.html
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.