CVE-2021-23175: nvidia geforce_experience Incorrect Authorization

Vulnerability summary

CVE-2021-23175 is a high (CVSS 8.2) Incorrect Authorization vulnerability in nvidia geforce_experience. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 36.8% of scored vulnerabilities.

Timeline

1. 23-12-2021
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

NVIDIA GeForce Experience contains a vulnerability in user authorization, where GameStream does not correctly apply individual user access controls for users on the same device, which, with user intervention, may lead to escalation of privileges, information disclosure, data tampering, and denial of service, affecting other resources beyond the intended security authority of GameStream.

• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.