Home » Database

AVID-2026-R1178

Description

Vulnerability CVE-2023-22355

Details

Uncontrolled search path in some Intel(R) oneAPI Toolkit and component software installers before version 4.3.0.251 may allow an authenticated user to potentially enable escalation of privilege via local access.

Reason for inclusion in AVID: CVE-2023-22355 describes an uncontrolled search path vulnerability in Intel oneAPI Toolkit installers, enabling local privilege escalation. Intel oneAPI is a software stack commonly used in AI/ML workloads, so a vulnerability in its installers constitutes a software supply-chain risk affecting AI systems. The report provides explicit CVE details, affected product, impact metrics, and references.

References

Affected or Relevant Artifacts

  • Developer: n/a
  • Deployer: n/a
  • Artifact Details:
TypeName
SystemIntel(R) oneAPI Toolkit and component software installers

Impact

AVID Taxonomy Categorization

  • Risk domains: Security
  • SEP subcategories: S0100: Software Vulnerability
  • Lifecycle stages: L06: Deployment

CVSS

Version3.1
Vector StringCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Base Score6.7
Base Severity🟠 Medium
Attack VectorLOCAL
Attack Complexity🔴 High
Privileges Required🟢 Low
User InteractionREQUIRED
ScopeUNCHANGED
Confidentiality Impact🔴 High
Integrity Impact🔴 High
Availability Impact🔴 High

CWE

IDDescription
CWE-427Uncontrolled search path

Other information

  • Report Type: Advisory
  • Credits:
  • Date Reported: 2023-05-10
  • Version: 0.3.3
  • AVID Entry