What is CVE-2022-3368?

CVE-2022-3368 is a high-severity vulnerability in Avira Security, classified under Incorrect Default Permissions. CVSS score: 7.3/10. Published 2022-10-17.

How severe is CVE-2022-3368?

High severity. CVSS v3 base score is 7.3 out of 10.

Is CVE-2022-3368 known to be exploited?

9 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Avira Security

CVE-2022-3368

A vulnerability within the Software Updater functionality of Avira Security for Windows allowed an attacker with write access to the filesystem, to escalate his privileges in certain scenarios. The issue was fixed with Avira Security version 1.1.72.30556.

EPSS: 0.008 (53.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H.

Affected products

Avira Avira_security
Nortonlifelock "Avira Security" – For Windows — versions all

Weakness classification (CWE)

CWE-276 — Incorrect Default Permissions

Public proof-of-concept exploits

References

security@nortonlifelock.com (Vendor Advisory)

Frequently asked questions

What is CVE-2022-3368?: CVE-2022-3368 is a high-severity vulnerability in Avira Security, classified under Incorrect Default Permissions. CVSS score: 7.3/10. Published 2022-10-17.
How severe is CVE-2022-3368?: High severity. CVSS v3 base score is 7.3 out of 10.
Is CVE-2022-3368 known to be exploited?: 9 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.