CVE-2022-38396
Last modified
CVE-2022-38396 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. HP Factory Preinstalled Images on certain systems that shipped with Windows 10 versions 20H2 and earlier OS versions might allow escalation of privilege via execution of certain files outside the restricted path. This potential vulnerability was remediated starting with Windows 10 versions 21H2 on October 31, 2021.. EPSS estimates a 0.41% chance of exploitation in the next 30 days.
Description
HP Factory Preinstalled Images on certain systems that shipped with Windows 10 versions 20H2 and earlier OS versions might allow escalation of privilege via execution of certain files outside the restricted path. This potential vulnerability was remediated starting with Windows 10 versions 21H2 on October 31, 2021.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Windows 10 1507 | All versions |
| Microsoft | Windows 10 1511 | All versions |
| Microsoft | Windows 10 1607 | All versions |
| Microsoft | Windows 10 1703 | All versions |
| Microsoft | Windows 10 1709 | All versions |
| Microsoft | Windows 10 1803 | All versions |
| Microsoft | Windows 10 1809 | All versions |
| Microsoft | Windows 10 1909 | All versions |
| Microsoft | Windows 10 2004 | All versions |
| Microsoft | Windows 10 20h2 | All versions |
References
- https://support.hp.com/ie-en/document/ish_7620368-7620413-16Vendor Advisory
- https://support.hp.com/ie-en/document/ish_7620368-7620413-16Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-38396?
How severe is CVE-2022-38396?
How do I fix CVE-2022-38396?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-38390Multiple IBM Business Automation Workflow versions are vulne…5.4
- CVE-2022-38391 IBM Spectrum Control 5.4 uses weaker than expected cryptogr…7.5
- CVE-2022-38392Certain 5400 RPM hard drives, for laptops and other PCs in a…5.3
- CVE-2022-38393A denial of service vulnerability exists in the cfg_server c…7.5
- CVE-2022-38394Use of hard-coded credentials for the telnet server of Centr…9.8
- CVE-2022-38395HP Support Assistant uses HP Performance Tune-up as a diagno…7.8
- CVE-2022-38398Server-Side Request Forgery (SSRF) vulnerability in Batik of…5.3
- CVE-2022-38399Missing protection mechanism for alternate hardware interfac…6.8
- CVE-2022-3840The Login for Google Apps WordPress plugin before 3.4.5 does…4.8
- CVE-2022-38400Mailform Pro CGI 4.3.1 and earlier allow a remote unauthenti…5.9
- CVE-2022-38401Adobe InCopy version 17.3 (and earlier) and 16.4.2 (and earl…7.8
- CVE-2022-38402Adobe InCopy version 17.3 (and earlier) and 16.4.2 (and earl…7.8
Are you affected by CVE-2022-38396?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST