CVE-2022-48225

Published Apr 4, 2023

Last updated 2 years ago

Overview

Description: An issue was discovered in Acuant AcuFill SDK before 10.22.02.03. It is used to install drivers from several different vendors. The Gemalto Document Reader child installation process is vulnerable to DLL hijacking, because it attempts to execute (with elevated privileges) multiple non-existent DLLs out of a non-existent standard-user writable location.
Source: cve@mitre.org
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.3
Impact score: 5.9
Exploitability score: 1.3
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

nvd@nist.gov: CWE-427

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:gbgplc:acuant_acufill_sdk:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C982B4DA-273F-4B30-B931-2988851C07A5",
            "versionEndExcluding": "10.22.02.03"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References