Skip to content
Fencer Vulns
medium 6.7

CVE-2023-28823 json

Uncontrolled search path in some Intel(R) oneAPI Toolkit and component software installers before version 4.3.1.493 may allow an authentica…

published 2023-08-11 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-32455

cvss
6.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 6%
public exploits
0
none known

Summary

Uncontrolled search path in some Intel(R) oneAPI Toolkit and component software installers before version 4.3.1.493 may allow an authenticated user to potentially enable escalation of privilege via local access.

Patch / fix

  • intel advisor_for_oneapi 2023.1
  • intel cpu_runtime_for_opencl_applications 2023.1
  • intel distribution_for_python_programming_language 2023.1
  • intel dpc++_compatibility_tool 2023.1
  • intel embree_ray_tracing_kernel_library 2023.1
  • intel fortran_compiler 2023.1
  • intel implicit_spmd_program_compiler 1.19.1
  • intel inspector_for_oneapi 2023.1
  • intel integrated_performance_primitives 2021.8
  • intel ipp_cryptography 2021.7.0
  • intel mpi_library 2021.9.0
  • intel oneapi_base_toolkit 2023.1
  • intel oneapi_data_analytics_library 2023.1
  • intel oneapi_deep_neural_network_library 2023.1
  • intel oneapi_dpc++/c++_compiler 2023.1
  • intel oneapi_dpc++_library_(onedpl) 2022.1
  • intel oneapi_hpc_toolkit 2023.1
  • intel oneapi_iot_toolkit 2023.1
  • intel oneapi_math_kernel_library 2023.1
  • intel oneapi_rendering_toolkit 2023.1

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

0.17% chance of exploitation in the next 30 days, higher than 6% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
NVD 3.1 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Affected products

  • n/a Intel(R) oneAPI Toolkit and component software installers

Classification

Weakness
  • CWE-427 Uncontrolled Search Path Element

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.