CVE-2022-34392 Information disclosure in SupportAssist
An authenticated non-admin user can reuse access tokens to fetch sensitive information due to insufficient session expiration in Dell SupportAssist.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-34392?
CVE-2022-34392 is a medium-severity vulnerability in Dell SupportAssist, published on 10 Feb 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
SupportAssist for Home PCs (versions 3.11.4 and prior) contain an insufficient session expiration Vulnerability. An authenticated non-admin user can be able to obtain the refresh token and that leads to reuse the access token and fetch sensitive information.
Weakness: CWE-613
Which versions are affected by CVE-2022-34392?
It affects 1 product.
Products include Dell Supportassist for Home Pcs.
How do I fix CVE-2022-34392?
No fix has been published for CVE-2022-34392 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-34392 being exploited?
There is no known exploitation of CVE-2022-34392 in the wild and no public exploit code.
Other vulnerabilities in Dell SupportAssist
- CVE-2021-36297 Other in SupportAssist Client Consumer
- CVE-2024-38305 Privilege escalation in SupportAssist for Home PCs
- CVE-2023-48670 Privilege escalation in SupportAssist Client Consumer
- CVE-2023-25535 Privilege escalation in SupportAssist Client Consumer
- CVE-2025-38738 Privilege escalation in SupportAssist for Home PCs
Sources
Also known as GHSA-p45m-mv49-39fw.