What is the CVSS score of CVE-2022-1697?

CVE-2022-1697 has a CVSS 3.1 base score of 3.9 (Low). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Active Directory Agent CVE-2022-1697

LOW

Unquoted Search Path or Element (CWE-428)

2022-09-06 psirt@okta.com

Information Disclosure Active Directory Agent

3.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.9 LOW

AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

CVE Published

Sep 06, 2022 - 18:15 nvd

LOW 3.9

DescriptionNVD

Okta Active Directory Agent versions 3.8.0 through 3.11.0 installed the Okta AD Agent Update Service using an unquoted path. Note: To remediate this vulnerability, you must uninstall Okta Active Directory Agent and reinstall Okta Active Directory Agent 3.12.0 or greater per the documentation.

AnalysisAI

Okta Active Directory Agent versions 3.8.0 through 3.11.0 installed the Okta AD Agent Update Service using an unquoted path. Rated low severity (CVSS 3.9). No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-428. Okta Active Directory Agent versions 3.8.0 through 3.11.0 installed the Okta AD Agent Update Service using an unquoted path. Note: To remediate this vulnerability, you must uninstall Okta Active Directory Agent and reinstall Okta Active Directory Agent 3.12.0 or greater per the documentation. Affected products include: Okta Active Directory Agent. Version information: through 3.11.0.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.