« Volver al listado

CVE-2020-12303

Estado: ModificadaAlta (7.8)—

Use after free in DAL subsystem for Intel(R) CSME versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25, Intel(R) TXE 3.1.80, 4.0.30 may allow an authenticated user to potentially enable escalation of privileges via local access.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Intel — Converged Security AND Manageability EngineIntel — Trusted Execution Technology

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-12303",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.6,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "secure@intel.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Intel(R) CSME, Intel(R) TXE",
          "versions": [
            {
              "status": "affected",
              "version": "Intel(R) CSME versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25, Intel(R) TXE 3.1.80, 4.0.30"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-11-12T18:15:13.517",
  "references": [
    {
      "url": "https://security.netapp.com/advisory/ntap-20201113-0002/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "secure@intel.com"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20201113-0005/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "secure@intel.com"
    },
    {
      "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00391",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secure@intel.com"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20201113-0002/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.netapp.com/advisory/ntap-20201113-0005/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00391",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-416"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Use after free in DAL subsystem for Intel(R) CSME versions before 11.8.80, 11.12.80, 11.22.80, 12.0.70, 13.0.40, 13.30.10, 14.0.45 and 14.5.25, Intel(R) TXE 3.1.80, 4.0.30 may allow an authenticated user to potentially enable escalation of privileges via local access."
    },
    {
      "lang": "es",
      "value": "Un uso de la memoria previamente liberada en el subsistema DAL para Intel® CSME versiones anteriores a 11.8.80, 11.12.80, 11.22.80, 12.0.70, 13.0.40, 13.30.10, 14.0.45 y 14.5.25, Intel® TXE versiones 3.1.80, 4.0.30 puede habilitar a un usuario autenticado para permitir potencialmente una escalada de privilegios por medio de un acceso local"
    }
  ],
  "lastModified": "2026-06-17T02:51:36.110",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:intel:converged_security_and_manageability_engine:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BA64E7EE-8977-4427-9FF9-DD9FE80F02C6",
              "versionEndExcluding": "11.8.80"
            },
            {
              "criteria": "cpe:2.3:a:intel:converged_security_and_manageability_engine:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3DDDD0D3-CE11-49C7-93F7-F2AA1053DD86",
              "versionEndExcluding": "11.12.80",
              "versionStartIncluding": "11.12.0"
            },
            {
              "criteria": "cpe:2.3:a:intel:converged_security_and_manageability_engine:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7A5C4B3E-3C68-4D2B-A181-18A71378362E",
              "versionEndExcluding": "11.22.80",
              "versionStartIncluding": "11.22.0"
            },
            {
              "criteria": "cpe:2.3:a:intel:converged_security_and_manageability_engine:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EB22E6F2-D34F-4A05-9CC2-BCAF3E84F54E",
              "versionEndExcluding": "12.0.70",
              "versionStartIncluding": "12.0"
            },
            {
              "criteria": "cpe:2.3:a:intel:converged_security_and_manageability_engine:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "94D40FF5-8E0A-4591-9CE4-2E671C8E4F2E",
              "versionEndExcluding": "14.0.45",
              "versionStartIncluding": "14.0"
            },
            {
              "criteria": "cpe:2.3:a:intel:converged_security_and_manageability_engine:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2B323721-380E-4222-AB7A-9993BF8DA653",
              "versionEndExcluding": "14.5.25",
              "versionStartIncluding": "14.5.0"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:intel:trusted_execution_technology:3.1.80:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F77A0250-5C61-4087-9ED0-315D64FDA70B"
            },
            {
              "criteria": "cpe:2.3:a:intel:trusted_execution_technology:4.0.30:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D9417CE8-97BF-4BB6-AF2A-1FC8C2B4A05B"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@intel.com"
}