CVE-2022-3700

MediumCVSS 6.3/10Last modified Jun 17, 2026

Description

A Time of Check Time of Use (TOCTOU) vulnerability was reported in the Lenovo Vantage SystemUpdate Plugin version 2.0.0.212 and earlier that could allow a local attacker to delete arbitrary files.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-367

Affected software

VendorProductVersions
LenovoVantage SystemUpdate Plugin< 2.0.0.213

References

Timeline

Published
Oct 27, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-370006.5An issue was discovered in Veritas NetBackup 8.1.x through 8.1.2, 8.2, 8.3.x through 8.3.0.2, 9.x through 9.0.0.1, and 9.1.x through 9.1.0.1CVE-2022-370017.5The diag-router module has a vulnerability in intercepting excessive long and short instructions. Successful exploitation of this vulnerabilCVE-2022-370029.8The SystemUI module has a privilege escalation vulnerability. Successful exploitation of this vulnerability can cause malicious applicationsCVE-2022-370039.8The AOD module has a vulnerability in permission assignment. Successful exploitation of this vulnerability may cause permission escalation aCVE-2022-370047.5The Settings application has a vulnerability of bypassing the out-of-box experience (OOBE). Successful exploitation of this vulnerability maCVE-2022-370057.5The Settings application has an argument injection vulnerability. Successful exploitation of this vulnerability may affect data confidentialCVE-2022-370067.5Permission control vulnerability in the network module. Successful exploitation of this vulnerability may affect service availability.CVE-2022-370077.5The chinadrm module has an out-of-bounds read vulnerability. Successful exploitation of this vulnerability may affect the availability.CVE-2022-370087.5The recovery module has a vulnerability of bypassing the verification of an update package before use. Successful exploitation of this vulneCVE-2022-370097.8In JetBrains IntelliJ IDEA before 2022.2 local code execution via a Vagrant executable was possibleCVE-2022-37017.8A privilege elevation vulnerability was reported in the Lenovo Vantage SystemUpdate plugin version 2.0.0.212 and earlier that could allow a CVE-2022-370103.3In JetBrains IntelliJ IDEA before 2022.2 email address validation in the "Git User Name Is Not Defined" dialog was missed
CVE-2022-3700: Medium severity, CVSS 6.3 | Vulnix