CVE-2023-22355 json
Uncontrolled search path in some Intel(R) oneAPI Toolkit and component software installers before version 4.3.0.251 may allow an authentica…
published 2023-05-10 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-26518
- cvss
- 6.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 11%
- public exploits
- 0
- none known
Summary
Uncontrolled search path in some Intel(R) oneAPI Toolkit and component software installers before version 4.3.0.251 may allow an authenticated user to potentially enable escalation of privilege via local access.
Patch / fix
- intel advisor 2023.0
- intel cpu_runtime 2023.0
- intel distribution_for_python 2023.0
- intel dpc++_compatibility_tool 2023.0
- intel embree_ray_tracing_kernel_library 2023.0
- intel fortran_compiler 2023.0
- intel implicit_spmd_program_compiler 1.18.1
- intel inspector 2023.0
- intel integrated_performance_primitives 2021.7
- intel integrated_performance_primitives_cryptography 2021.6.3
- intel mpi_library 2021.8
- intel oneapi_base_toolkit 2023.0
- intel oneapi_data_analytics_library 2023.0
- intel oneapi_deep_neural_network_library 2023.0
- intel oneapi_dpc++/c++_compiler 2023.0
- intel oneapi_dpc++_library 2022.0
- intel oneapi_hpc_toolkit 2023.0.0
- intel oneapi_iot_toolkit 2023.0
- intel oneapi_math_kernel_library 2023.0
- intel oneapi_rendering_toolkit 2023.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 21 mo ago
Exploit prediction
0.21% chance of exploitation in the next 30 days, higher than 11% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.7 | CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected products
- n/a Intel(R) oneAPI Toolkit and component software installers
Classification
- Weakness
-
- CWE-427 Uncontrolled Search Path Element
References
Sources
- CVE List CVE-2023-22355
- NVD CVE-2023-22355
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.