description:
NVIDIA GeForce Experience contains a vulnerability in the NVContainer component, where a user without administrator privileges can create a symbolic link to a file that requires elevated privileges to write to or modify, which may lead to denial of service, escalation of privilege or limited data tampering.
problem types: CWE-59 Improper Link Resolution Before File Access ('Link Following')
affected:
{
defaultStatus: unaffected
platforms: Windows
product: GeForce Experience
vendor: NVIDIA
versions:
status: affected, version: All versions prior to 3.27.0.112
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL