Uncleared password keystrokes in circular queue can lead to information disclosure or escalation of privilege (TianoCore EDK2)
En bref
- Source
- NVD
- EPSS
- EPSS 0.14 % · centile 4 ()
- Ătat
- PUBLISHED
- Publiée
- Mise Ă jour
- Attribuée par
- TianoCore
- Statut NVD
- Deferred
Description
EDK2 contains a vulnerability in BIOS where an attacker may cause âExposure of Sensitive Information to an Unauthorized Actorâ by local access. Successful exploitation of this vulnerability will lead to possible information disclosure or escalation of privilege and impact Confidentiality.
Faiblesses (CWE)
- CWE-200 â Exposition d'informations sensibles Ă un acteur non autorisĂ©
Références
Scores
| Version | Score | Vecteur | ĂvaluĂ© par |
|---|---|---|---|
| CVSS 4.0 | MEDIUM 5.8 | CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L | TianoCore |
| CVSS 4.0 | MEDIUM 5.8 | CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · infosec@edk2.groups.io (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2024-55310
- GCVE · GCVE-0-2024-38798
Produits affectés
| Produit | Versions |
|---|---|
| TianoCore · EDK2 | affected 0 < edk2-stable202511 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST â attribution requested |
| ENISA EUVD | ENISA â reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain â this product uses data from the NVD API but is not endorsed or certified by the NVD |