CVE-2022-38395 - Vulnerability Details - OpenCVE

HP Support Assistant uses HP Performance Tune-up as a diagnostic tool. HP Support Assistant uses Fusion to launch HP Performance Tune-up. It is possible for an attacker to exploit the DLL hijacking vulnerability and elevate privileges when Fusion launches the HP Performance Tune-up.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Hp	Fusion Support Assistant

Configuration 1 [-]

OR	cpe:2.3:a:hp:fusion::::::::
	cpe:2.3:a:hp:support_assistant::::::::

No data.

References

Link	Providers
https://support.hp.com/us-en/document/ish_6788123-6788147-16/hpsbhf03809

History

Tue, 29 Apr 2025 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: hp

Published: 2022-11-18T20:52:28.312Z

Updated: 2025-04-29T18:35:19.184Z

Reserved: 2022-08-17T21:59:36.744Z

Link: CVE-2022-38395

Vulnrichment

Updated: 2024-08-03T10:54:03.601Z

NVD

Status : Modified

Published: 2022-12-12T13:15:14.420

Modified: 2025-04-29T19:15:51.787

Link: CVE-2022-38395

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2022-38395", "assignerOrgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2", "state": "PUBLISHED", "assignerShortName": "hp", "requesterUserId": "e0158710-d811-4b94-9318-6cef34bebe03", "dateReserved": "2022-08-17T21:59:36.744Z", "datePublished": "2022-11-18T20:52:28.312Z", "dateUpdated": "2025-04-29T18:35:19.184Z"}, "containers": {"cna": {"descriptions": [{"lang": "en", "value": "HP Support Assistant uses HP Performance Tune-up as a diagnostic tool. HP Support Assistant uses Fusion to launch HP Performance Tune-up. It is possible for an attacker to exploit the DLL hijacking vulnerability and elevate privileges when Fusion launches the HP Performance Tune-up."}], "affected": [{"versions": [{"version": "See HP Security Bulletin reference for affected versions.", "status": "affected"}], "product": "HP Support Assistant", "vendor": "HP Inc."}], "references": [{"url": "https://support.hp.com/us-en/document/ish_6788123-6788147-16/hpsbhf03809"}], "providerMetadata": {"orgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2", "shortName": "hp", "dateUpdated": "2022-12-12T12:11:04.548Z"}, "x_generator": {"engine": "cveClient/1.0.13"}, "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T10:54:03.601Z"}, "title": "CVE Program Container", "references": [{"url": "https://support.hp.com/us-en/document/ish_6788123-6788147-16/hpsbhf03809", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-427", "lang": "en", "description": "CWE-427 Uncontrolled Search Path Element"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-04-29T18:34:43.793729Z", "id": "CVE-2022-38395", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-29T18:35:19.184Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://support.hp.com/us-en/document/ish_6788123-6788147-16/hpsbhf03809", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T10:54:03.601Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2022-38395", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-04-29T18:34:43.793729Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-427", "description": "CWE-427 Uncontrolled Search Path Element"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-29T18:34:52.753Z"}}], "cna": {"affected": [{"vendor": "HP Inc.", "product": "HP Support Assistant", "versions": [{"status": "affected", "version": "See HP Security Bulletin reference for affected versions."}]}], "references": [{"url": "https://support.hp.com/us-en/document/ish_6788123-6788147-16/hpsbhf03809"}], "x_generator": {"engine": "cveClient/1.0.13"}, "descriptions": [{"lang": "en", "value": "HP Support Assistant uses HP Performance Tune-up as a diagnostic tool. HP Support Assistant uses Fusion to launch HP Performance Tune-up. It is possible for an attacker to exploit the DLL hijacking vulnerability and elevate privileges when Fusion launches the HP Performance Tune-up."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2", "shortName": "hp", "dateUpdated": "2022-12-12T12:11:04.548Z"}}}, "cveMetadata": {"cveId": "CVE-2022-38395", "state": "PUBLISHED", "dateUpdated": "2025-04-29T18:35:19.184Z", "dateReserved": "2022-08-17T21:59:36.744Z", "assignerOrgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2", "datePublished": "2022-11-18T20:52:28.312Z", "requesterUserId": "e0158710-d811-4b94-9318-6cef34bebe03", "assignerShortName": "hp"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hp:fusion:*:*:*:*:*:*:*:*", "matchCriteriaId": "F188B38C-D8CC-4301-AD55-ADF9A2792362", "versionEndExcluding": "1.38.2601.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:hp:support_assistant:*:*:*:*:*:*:*:*", "matchCriteriaId": "7FD4D0FD-F788-4F4D-AE4E-B45D0BD0F37C", "versionEndExcluding": "9.11", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "HP Support Assistant uses HP Performance Tune-up as a diagnostic tool. HP Support Assistant uses Fusion to launch HP Performance Tune-up. It is possible for an attacker to exploit the DLL hijacking vulnerability and elevate privileges when Fusion launches the HP Performance Tune-up."}, {"lang": "es", "value": "HP Support Assistant utiliza HP Performance Tune-up como herramienta de diagn\u00f3stico. HP Support Assistant utiliza Fusion para iniciar HP Performance Tune-up. Es posible que un atacante aproveche la vulnerabilidad de secuestro de DLL y eleve los privilegios cuando Fusion inicia HP Performance Tune-up."}], "id": "CVE-2022-38395", "lastModified": "2025-04-29T19:15:51.787", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2022-12-12T13:15:14.420", "references": [{"source": "hp-security-alert@hp.com", "tags": ["Vendor Advisory"], "url": "https://support.hp.com/us-en/document/ish_6788123-6788147-16/hpsbhf03809"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://support.hp.com/us-en/document/ish_6788123-6788147-16/hpsbhf03809"}], "sourceIdentifier": "hp-security-alert@hp.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-427"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-427"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}