High severity · published Oct 27, 2023
CVE-2022-3611
An information disclosure vulnerability has been identified in the Lenovo App Store which may allow some applications to gain unauthorized access to sensitive user data used by…
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
An information disclosure vulnerability has been identified in the Lenovo App Store which may allow some applications to gain unauthorized access to sensitive user data used by other unrelated applications.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
App Store · Lenovo
before 11.8.0 · source: vendor
AS
App Store App · Lenovo
before 11.8.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-3611
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-3611
Third Party Advisory
https://iknow.lenovo.com.cn/detail/205280.html
More from App Store
7.8
CVE-2025-12046
A DLL hijacking vulnerability was reported in the Lenovo App Store and Lenovo Browser applications that could allow a local authenticated user to execute code with elevated…
7.8
CVE-2024-4130
A DLL hijack vulnerability was reported in Lenovo App Store that could allow a local attacker to execute code with elevated privileges
7.5
CVE-2025-10495
A potential vulnerability was reported in the Lenovo PC Manager, Lenovo App Store, Lenovo Browser, and Lenovo Legion Zone client applications that, under certain conditions, could…
7.3
CVE-2026-13104
A potential vulnerability was reported in Lenovo App Store, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute arbitrary code…
7.3
CVE-2026-13103
A potential path traversal vulnerability was reported in Lenovo App Store, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute…