Microsoft CVE Summary

This report contains detail for the following vulnerabilities:

Tag CVE ID CVE Title
.NET Framework CVE-2022-41089 .NET Framework Remote Code Execution Vulnerability
Azure CVE-2022-44699 Azure Network Watcher Agent Security Feature Bypass Vulnerability
Client Server Run-time Subsystem (CSRSS) CVE-2022-44673 Windows Client Server Run-Time Subsystem (CSRSS) Elevation of Privilege Vulnerability
Microsoft Bluetooth Driver CVE-2022-44675 Windows Bluetooth Driver Elevation of Privilege Vulnerability
Microsoft Bluetooth Driver CVE-2022-44674 Windows Bluetooth Driver Information Disclosure Vulnerability
Microsoft Dynamics CVE-2022-41127 Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability
Microsoft Edge (Chromium-based) CVE-2022-4192 Chromium: CVE-2022-4192 Use after free in Live Caption
Microsoft Edge (Chromium-based) CVE-2022-4193 Chromium: CVE-2022-4193 Insufficient policy enforcement in File System API
Microsoft Edge (Chromium-based) CVE-2022-4190 Chromium: CVE-2022-4190 Insufficient data validation in Directory
Microsoft Edge (Chromium-based) CVE-2022-4191 Chromium: CVE-2022-4191 Use after free in Sign-In
Microsoft Edge (Chromium-based) CVE-2022-4194 Chromium: CVE-2022-4194 Use after free in Accessibility
Microsoft Edge (Chromium-based) CVE-2022-41115 Microsoft Edge (Chromium-based) Update Elevation of Privilege Vulnerability
Microsoft Edge (Chromium-based) CVE-2022-44688 Microsoft Edge (Chromium-based) Spoofing Vulnerability
Microsoft Edge (Chromium-based) CVE-2022-4195 Chromium: CVE-2022-4195 Insufficient policy enforcement in Safe Browsing
Microsoft Edge (Chromium-based) CVE-2022-44708 Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Microsoft Edge (Chromium-based) CVE-2022-4181 Chromium: CVE-2022-4181 Use after free in Forms
Microsoft Edge (Chromium-based) CVE-2022-4180 Chromium: CVE-2022-4180 Use after free in Mojo
Microsoft Edge (Chromium-based) CVE-2022-4174 Chromium: CVE-2022-4174 Type Confusion in V8
Microsoft Edge (Chromium-based) CVE-2022-4182 Chromium: CVE-2022-4182 Inappropriate implementation in Fenced Frames
Microsoft Edge (Chromium-based) CVE-2022-4179 Chromium: CVE-2022-4179 Use after free in Audio
Microsoft Edge (Chromium-based) CVE-2022-4178 Chromium: CVE-2022-4178 Use after free in Mojo
Microsoft Edge (Chromium-based) CVE-2022-4175 Chromium: CVE-2022-4175 Use after free in Camera Capture
Microsoft Edge (Chromium-based) CVE-2022-4177 Chromium: CVE-2022-4177 Use after free in Extensions
Microsoft Edge (Chromium-based) CVE-2022-4187 Chromium: CVE-2022-4187 Insufficient policy enforcement in DevTools
Microsoft Edge (Chromium-based) CVE-2022-4185 Chromium: CVE-2022-4185 Inappropriate implementation in Navigation
Microsoft Edge (Chromium-based) CVE-2022-4188 Chromium: CVE-2022-4188 Insufficient validation of untrusted input in CORS
Microsoft Edge (Chromium-based) CVE-2022-4189 Chromium: CVE-2022-4189 Insufficient policy enforcement in DevTools
Microsoft Edge (Chromium-based) CVE-2022-4186 Chromium: CVE-2022-4186 Insufficient validation of untrusted input in Downloads
Microsoft Edge (Chromium-based) CVE-2022-4183 Chromium: CVE-2022-4183 Insufficient policy enforcement in Popup Blocker
Microsoft Edge (Chromium-based) CVE-2022-4184 Chromium: CVE-2022-4184 Insufficient policy enforcement in Autofill
Microsoft Graphics Component CVE-2022-26805 Microsoft Office Graphics Remote Code Execution Vulnerability
Microsoft Graphics Component CVE-2022-26804 Microsoft Office Graphics Remote Code Execution Vulnerability
Microsoft Graphics Component CVE-2022-47213 Microsoft Office Graphics Remote Code Execution Vulnerability
Microsoft Graphics Component CVE-2022-44697 Windows Graphics Component Elevation of Privilege Vulnerability
Microsoft Graphics Component CVE-2022-41121 Windows Graphics Component Elevation of Privilege Vulnerability
Microsoft Graphics Component CVE-2022-44671 Windows Graphics Component Elevation of Privilege Vulnerability
Microsoft Graphics Component CVE-2022-47212 Microsoft Office Graphics Remote Code Execution Vulnerability
Microsoft Graphics Component CVE-2022-26806 Microsoft Office Graphics Remote Code Execution Vulnerability
Microsoft Graphics Component CVE-2022-47211 Microsoft Office Graphics Remote Code Execution Vulnerability
Microsoft Graphics Component CVE-2022-41074 Windows Graphics Component Information Disclosure Vulnerability
Microsoft Graphics Component CVE-2022-44679 Windows Graphics Component Information Disclosure Vulnerability
Microsoft Graphics Component CVE-2022-44680 Windows Graphics Component Elevation of Privilege Vulnerability
Microsoft Office CVE-2022-44692 Microsoft Office Graphics Remote Code Execution Vulnerability
Microsoft Office OneNote CVE-2022-44691 Microsoft Office OneNote Remote Code Execution Vulnerability
Microsoft Office Outlook CVE-2022-24480 Outlook for Android Elevation of Privilege Vulnerability
Microsoft Office Outlook CVE-2022-44713 Microsoft Outlook for Mac Spoofing Vulnerability
Microsoft Office SharePoint CVE-2022-44690 Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft Office SharePoint CVE-2022-44693 Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft Office Visio CVE-2022-44696 Microsoft Office Visio Remote Code Execution Vulnerability
Microsoft Office Visio CVE-2022-44695 Microsoft Office Visio Remote Code Execution Vulnerability
Microsoft Office Visio CVE-2022-44694 Microsoft Office Visio Remote Code Execution Vulnerability
Microsoft Windows Codecs Library CVE-2022-44668 Windows Media Remote Code Execution Vulnerability
Microsoft Windows Codecs Library CVE-2022-44667 Windows Media Remote Code Execution Vulnerability
Microsoft Windows Codecs Library CVE-2022-44687 Raw Image Extension Remote Code Execution Vulnerability
Role: Windows Hyper-V CVE-2022-41094 Windows Hyper-V Elevation of Privilege Vulnerability
Role: Windows Hyper-V CVE-2022-44682 Windows Hyper-V Denial of Service Vulnerability
SysInternals CVE-2022-44704 Microsoft Windows Sysmon Elevation of Privilege Vulnerability
Windows Certificates ADV220005 Guidance on Microsoft Signed Drivers Being Used Maliciously
Windows Contacts CVE-2022-44666 Windows Contacts Remote Code Execution Vulnerability
Windows DirectX CVE-2022-44710 DirectX Graphics Kernel Elevation of Privilege Vulnerability
Windows Error Reporting CVE-2022-44669 Windows Error Reporting Elevation of Privilege Vulnerability
Windows Fax Compose Form CVE-2022-41077 Windows Fax Compose Form Elevation of Privilege Vulnerability
Windows HTTP Print Provider CVE-2022-44678 Windows Print Spooler Elevation of Privilege Vulnerability
Windows Kernel CVE-2022-44707 Windows Kernel Denial of Service Vulnerability
Windows Kernel CVE-2022-44683 Windows Kernel Elevation of Privilege Vulnerability
Windows PowerShell CVE-2022-41076 PowerShell Remote Code Execution Vulnerability
Windows Print Spooler Components CVE-2022-44681 Windows Print Spooler Elevation of Privilege Vulnerability
Windows Projected File System CVE-2022-44677 Windows Projected File System Elevation of Privilege Vulnerability
Windows Secure Socket Tunneling Protocol (SSTP) CVE-2022-44670 Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
Windows Secure Socket Tunneling Protocol (SSTP) CVE-2022-44676 Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
Windows SmartScreen CVE-2022-44698 Windows SmartScreen Security Feature Bypass Vulnerability
Windows Subsystem for Linux CVE-2022-44689 Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability
Windows Terminal CVE-2022-44702 Windows Terminal Remote Code Execution Vulnerability

CVE-2022-4174 - Chromium: CVE-2022-4174 Type Confusion in V8

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2022-4174
MITRE
NVD		 CVE Title: Chromium: CVE-2022-4174 Type Confusion in V8
CVSS:
None
FAQ:

Why is this Chrome CVE included in the Security Update Guide?

The vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable. Please see Security Update Guide Supports CVEs Assigned by Industry Partners for more information.

How can I see the version of the browser?

  1. In your Microsoft Edge browser, click on the 3 dots (...) on the very right-hand side of the window
  2. Click on Help and Feedback
  3. Click on About Microsoft Edge

What is the version information for this release?

Microsoft Edge Version Date Released Based on Chromium Version
108.0.1462.41 12/5/2022 108.0.5359.94

Mitigations:
None
Workarounds:
None
Revision:
1.0    2022-12-05T08:00:00    

Information published.


 Unknown Unknown

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Not Found Not Found Not Found

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2022-4174
Product KB Article Severity Impact Supercedence CVSS Score Set Restart Required
Microsoft Edge (Chromium-based) Release Notes (Security Update) Unknown Unknown None Base: N/A
Temporal: N/A
Vector: N/A
 No

Acknowledgements

CVE ID Acknowledgements
CVE-2022-4174 None

CVE-2022-4175 - Chromium: CVE-2022-4175 Use after free in Camera Capture

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2022-4175
MITRE
NVD		 CVE Title: Chromium: CVE-2022-4175 Use after free in Camera Capture
CVSS:
None
FAQ:

Why is this Chrome CVE included in the Security Update Guide?

The vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable. Please see Security Update Guide Supports CVEs Assigned by Industry Partners for more information.

How can I see the version of the browser?

  1. In your Microsoft Edge browser, click on the 3 dots (...) on the very right-hand side of the window
  2. Click on Help and Feedback
  3. Click on About Microsoft Edge

What is the version information for this release?

Microsoft Edge Version Date Released Based on Chromium Version
108.0.1462.41 12/5/2022 108.0.5359.94

Mitigations:
None
Workarounds:
None
Revision:
1.0    2022-12-05T08:00:00    

Information published.


 Unknown Unknown

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Not Found Not Found Not Found

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2022-4175
Product KB Article Severity Impact Supercedence CVSS Score Set Restart Required
Microsoft Edge (Chromium-based) Release Notes (Security Update) Unknown Unknown None Base: N/A
Temporal: N/A
Vector: N/A
 No

Acknowledgements

CVE ID Acknowledgements
CVE-2022-4175 None

CVE-2022-4177 - Chromium: CVE-2022-4177 Use after free in Extensions

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2022-4177
MITRE
NVD		 CVE Title: Chromium: CVE-2022-4177 Use after free in Extensions
CVSS:
None
FAQ:

Why is this Chrome CVE included in the Security Update Guide?

The vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable. Please see Security Update Guide Supports CVEs Assigned by Industry Partners for more information.

How can I see the version of the browser?

  1. In your Microsoft Edge browser, click on the 3 dots (...) on the very right-hand side of the window
  2. Click on Help and Feedback
  3. Click on About Microsoft Edge

What is the version information for this release?

Microsoft Edge Version Date Released Based on Chromium Version
108.0.1462.41 12/5/2022 108.0.5359.94

Mitigations:
None
Workarounds:
None
Revision:
1.0    2022-12-05T08:00:00    

Information published.


 Unknown Unknown

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Not Found Not Found Not Found

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2022-4177
Product KB Article Severity Impact Supercedence CVSS Score Set Restart Required
Microsoft Edge (Chromium-based) Release Notes (Security Update) Unknown Unknown None Base: N/A
Temporal: N/A
Vector: N/A
 No

Acknowledgements

CVE ID Acknowledgements
CVE-2022-4177 None

CVE-2022-4178 - Chromium: CVE-2022-4178 Use after free in Mojo

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2022-4178
MITRE
NVD		 CVE Title: Chromium: CVE-2022-4178 Use after free in Mojo
CVSS:
None
FAQ:

Why is this Chrome CVE included in the Security Update Guide?

The vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable. Please see Security Update Guide Supports CVEs Assigned by Industry Partners for more information.

How can I see the version of the browser?

  1. In your Microsoft Edge browser, click on the 3 dots (...) on the very right-hand side of the window
  2. Click on Help and Feedback
  3. Click on About Microsoft Edge

What is the version information for this release?

Microsoft Edge Version Date Released Based on Chromium Version
108.0.1462.41 12/5/2022 108.0.5359.94

Mitigations:
None
Workarounds:
None
Revision:
1.0    2022-12-05T08:00:00    

Information published.


 Unknown Unknown

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Not Found Not Found Not Found

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2022-4178
Product KB Article Severity Impact Supercedence CVSS Score Set Restart Required
Microsoft Edge (Chromium-based) Release Notes (Security Update) Unknown Unknown None Base: N/A
Temporal: N/A
Vector: N/A
 No

Acknowledgements

CVE ID Acknowledgements
CVE-2022-4178 None

CVE-2022-4179 - Chromium: CVE-2022-4179 Use after free in Audio

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2022-4179
MITRE
NVD		 CVE Title: Chromium: CVE-2022-4179 Use after free in Audio
CVSS:
None
FAQ:

Why is this Chrome CVE included in the Security Update Guide?

The vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable. Please see Security Update Guide Supports CVEs Assigned by Industry Partners for more information.

How can I see the version of the browser?

  1. In your Microsoft Edge browser, click on the 3 dots (...) on the very right-hand side of the window
  2. Click on Help and Feedback
  3. Click on About Microsoft Edge

What is the version information for this release?

Microsoft Edge Version Date Released Based on Chromium Version
108.0.1462.41 12/5/2022 108.0.5359.94

Mitigations:
None
Workarounds:
None
Revision:
1.0    2022-12-05T08:00:00    

Information published.


 Unknown Unknown

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Not Found Not Found Not Found

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2022-4179
Product KB Article Severity Impact Supercedence CVSS Score Set Restart Required
Microsoft Edge (Chromium-based) Release Notes (Security Update) Unknown Unknown None Base: N/A
Temporal: N/A
Vector: N/A
 No

Acknowledgements

CVE ID Acknowledgements
CVE-2022-4179 None

CVE-2022-4180 - Chromium: CVE-2022-4180 Use after free in Mojo

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2022-4180
MITRE
NVD		 CVE Title: Chromium: CVE-2022-4180 Use after free in Mojo
CVSS:
None
FAQ:

Why is this Chrome CVE included in the Security Update Guide?

The vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable. Please see Security Update Guide Supports CVEs Assigned by Industry Partners for more information.

How can I see the version of the browser?

  1. In your Microsoft Edge browser, click on the 3 dots (...) on the very right-hand side of the window
  2. Click on Help and Feedback
  3. Click on About Microsoft Edge

What is the version information for this release?

Microsoft Edge Version Date Released Based on Chromium Version
108.0.1462.41 12/5/2022 108.0.5359.94

Mitigations:
None
Workarounds:
None
Revision:
1.0    2022-12-05T08:00:00    

Information published.


 Unknown Unknown

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Not Found Not Found Not Found

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2022-4180
Product KB Article Severity Impact Supercedence CVSS Score Set Restart Required
Microsoft Edge (Chromium-based) Release Notes (Security Update) Unknown Unknown None Base: N/A
Temporal: N/A
Vector: N/A
 No

Acknowledgements

CVE ID Acknowledgements
CVE-2022-4180 None

CVE-2022-4181 - Chromium: CVE-2022-4181 Use after free in Forms

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2022-4181
MITRE
NVD		 CVE Title: Chromium: CVE-2022-4181 Use after free in Forms
CVSS:
None
FAQ:

Why is this Chrome CVE included in the Security Update Guide?

The vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable. Please see Security Update Guide Supports CVEs Assigned by Industry Partners for more information.

How can I see the version of the browser?

  1. In your Microsoft Edge browser, click on the 3 dots (...) on the very right-hand side of the window
  2. Click on Help and Feedback
  3. Click on About Microsoft Edge

What is the version information for this release?

Microsoft Edge Version Date Released Based on Chromium Version
108.0.1462.41 12/5/2022 108.0.5359.94

Mitigations:
None
Workarounds:
None
Revision:
1.0    2022-12-05T08:00:00    

Information published.


 Unknown Unknown

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Not Found Not Found Not Found

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2022-4181
Product KB Article Severity Impact Supercedence CVSS Score Set Restart Required
Microsoft Edge (Chromium-based) Release Notes (Security Update) Unknown Unknown None Base: N/A
Temporal: N/A
Vector: N/A
 No

Acknowledgements

CVE ID Acknowledgements
CVE-2022-4181 None

CVE-2022-4182 - Chromium: CVE-2022-4182 Inappropriate implementation in Fenced Frames

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2022-4182
MITRE
NVD		 CVE Title: Chromium: CVE-2022-4182 Inappropriate implementation in Fenced Frames
CVSS:
None
FAQ:

Why is this Chrome CVE included in the Security Update Guide?

The vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable. Please see Security Update Guide Supports CVEs Assigned by Industry Partners for more information.

How can I see the version of the browser?

  1. In your Microsoft Edge browser, click on the 3 dots (...) on the very right-hand side of the window
  2. Click on Help and Feedback
  3. Click on About Microsoft Edge

What is the version information for this release?

Microsoft Edge Version Date Released Based on Chromium Version
108.0.1462.41 12/5/2022 108.0.5359.94

Mitigations:
None
Workarounds:
None
Revision:
1.0    2022-12-05T08:00:00    

Information published.


 Unknown Unknown

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Not Found Not Found Not Found

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2022-4182
Product KB Article Severity Impact Supercedence CVSS Score Set Restart Required
Microsoft Edge (Chromium-based) Release Notes (Security Update) Unknown Unknown None Base: N/A
Temporal: N/A
Vector: N/A
 No

Acknowledgements

CVE ID Acknowledgements
CVE-2022-4182 None

CVE-2022-4183 - Chromium: CVE-2022-4183 Insufficient policy enforcement in Popup Blocker

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2022-4183
MITRE
NVD		 CVE Title: Chromium: CVE-2022-4183 Insufficient policy enforcement in Popup Blocker
CVSS:
None
FAQ:

Why is this Chrome CVE included in the Security Update Guide?

The vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable. Please see Security Update Guide Supports CVEs Assigned by Industry Partners for more information.

How can I see the version of the browser?

  1. In your Microsoft Edge browser, click on the 3 dots (...) on the very right-hand side of the window
  2. Click on Help and Feedback
  3. Click on About Microsoft Edge

What is the version information for this release?

Microsoft Edge Version Date Released Based on Chromium Version
108.0.1462.41 12/5/2022 108.0.5359.94

Mitigations:
None
Workarounds:
None
Revision:
1.0    2022-12-05T08:00:00    

Information published.


 Unknown Unknown

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Not Found Not Found Not Found

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2022-4183
Product KB Article Severity Impact Supercedence CVSS Score Set Restart Required
Microsoft Edge (Chromium-based) Release Notes (Security Update) Unknown Unknown None Base: N/A
Temporal: N/A
Vector: N/A
 No

Acknowledgements

CVE ID Acknowledgements
CVE-2022-4183 None

CVE-2022-4184 - Chromium: CVE-2022-4184 Insufficient policy enforcement in Autofill

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2022-4184
MITRE
NVD		 CVE Title: Chromium: CVE-2022-4184 Insufficient policy enforcement in Autofill
CVSS:
None
FAQ:

Why is this Chrome CVE included in the Security Update Guide?

The vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable. Please see Security Update Guide Supports CVEs Assigned by Industry Partners for more information.

How can I see the version of the browser?

  1. In your Microsoft Edge browser, click on the 3 dots (...) on the very right-hand side of the window
  2. Click on Help and Feedback
  3. Click on About Microsoft Edge

What is the version information for this release?

Microsoft Edge Version Date Released Based on Chromium Version
108.0.1462.41 12/5/2022 108.0.5359.94

Mitigations:
None
Workarounds:
None
Revision:
1.0    2022-12-05T08:00:00    

Information published.


 Unknown Unknown

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Not Found Not Found Not Found

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2022-4184
Product KB Article Severity Impact Supercedence CVSS Score Set Restart Required
Microsoft Edge (Chromium-based) Release Notes (Security Update) Unknown Unknown None Base: N/A
Temporal: N/A
Vector: N/A
 No

Acknowledgements

CVE ID Acknowledgements
CVE-2022-4184 None

CVE-2022-4185 - Chromium: CVE-2022-4185 Inappropriate implementation in Navigation

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2022-4185
MITRE
NVD		 CVE Title: Chromium: CVE-2022-4185 Inappropriate implementation in Navigation
CVSS:
None
FAQ:

Why is this Chrome CVE included in the Security Update Guide?

The vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable. Please see Security Update Guide Supports CVEs Assigned by Industry Partners for more information.

How can I see the version of the browser?

  1. In your Microsoft Edge browser, click on the 3 dots (...) on the very right-hand side of the window
  2. Click on Help and Feedback
  3. Click on About Microsoft Edge

What is the version information for this release?

Microsoft Edge Version Date Released Based on Chromium Version
108.0.1462.41 12/5/2022 108.0.5359.94

Mitigations:
None
Workarounds:
None
Revision:
1.0    2022-12-05T08:00:00    

Information published.


 Unknown Unknown

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Not Found Not Found Not Found

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2022-4185
Product KB Article Severity Impact Supercedence CVSS Score Set Restart Required
Microsoft Edge (Chromium-based) Release Notes (Security Update) Unknown Unknown None Base: N/A
Temporal: N/A
Vector: N/A
 No

Acknowledgements

CVE ID Acknowledgements
CVE-2022-4185 None

CVE-2022-4186 - Chromium: CVE-2022-4186 Insufficient validation of untrusted input in Downloads

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2022-4186
MITRE
NVD		 CVE Title: Chromium: CVE-2022-4186 Insufficient validation of untrusted input in Downloads
CVSS:
None
FAQ:

Why is this Chrome CVE included in the Security Update Guide?

The vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable. Please see Security Update Guide Supports CVEs Assigned by Industry Partners for more information.

How can I see the version of the browser?

  1. In your Microsoft Edge browser, click on the 3 dots (...) on the very right-hand side of the window
  2. Click on Help and Feedback
  3. Click on About Microsoft Edge

What is the version information for this release?

Microsoft Edge Version Date Released Based on Chromium Version
108.0.1462.41 12/5/2022 108.0.5359.94

Mitigations:
None
Workarounds:
None
Revision:
1.0    2022-12-05T08:00:00    

Information published.


 Unknown Unknown

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Not Found Not Found Not Found

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2022-4186
Product KB Article Severity Impact Supercedence CVSS Score Set Restart Required
Microsoft Edge (Chromium-based) Release Notes (Security Update) Unknown Unknown None Base: N/A
Temporal: N/A
Vector: N/A
 No

Acknowledgements

CVE ID Acknowledgements
CVE-2022-4186 None

CVE-2022-4187 - Chromium: CVE-2022-4187 Insufficient policy enforcement in DevTools

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2022-4187
MITRE
NVD		 CVE Title: Chromium: CVE-2022-4187 Insufficient policy enforcement in DevTools
CVSS:
None
FAQ:

Why is this Chrome CVE included in the Security Update Guide?

The vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable. Please see Security Update Guide Supports CVEs Assigned by Industry Partners for more information.

How can I see the version of the browser?

  1. In your Microsoft Edge browser, click on the 3 dots (...) on the very right-hand side of the window
  2. Click on Help and Feedback
  3. Click on About Microsoft Edge

What is the version information for this release?

Microsoft Edge Version Date Released Based on Chromium Version
108.0.1462.41 12/5/2022 108.0.5359.94

Mitigations:
None
Workarounds:
None
Revision:
1.0    2022-12-05T08:00:00    

Information published.


 Unknown Unknown

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Not Found Not Found Not Found

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2022-4187
Product KB Article Severity Impact Supercedence CVSS Score Set Restart Required
Microsoft Edge (Chromium-based) Release Notes (Security Update) Unknown Unknown None Base: N/A
Temporal: N/A
Vector: N/A
 No

Acknowledgements

CVE ID Acknowledgements
CVE-2022-4187 None

CVE-2022-4188 - Chromium: CVE-2022-4188 Insufficient validation of untrusted input in CORS

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2022-4188
MITRE
NVD		 CVE Title: Chromium: CVE-2022-4188 Insufficient validation of untrusted input in CORS
CVSS:
None
FAQ:

Why is this Chrome CVE included in the Security Update Guide?

The vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable. Please see Security Update Guide Supports CVEs Assigned by Industry Partners for more information.

How can I see the version of the browser?

  1. In your Microsoft Edge browser, click on the 3 dots (...) on the very right-hand side of the window
  2. Click on Help and Feedback
  3. Click on About Microsoft Edge

What is the version information for this release?

Microsoft Edge Version Date Released Based on Chromium Version
108.0.1462.41 12/5/2022 108.0.5359.94

Mitigations:
None
Workarounds:
None
Revision:
1.0    2022-12-05T08:00:00    

Information published.


 Unknown Unknown

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Not Found Not Found Not Found

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2022-4188
Product KB Article Severity Impact Supercedence CVSS Score Set Restart Required
Microsoft Edge (Chromium-based) Release Notes (Security Update) Unknown Unknown None Base: N/A
Temporal: N/A
Vector: N/A
 No

Acknowledgements

CVE ID Acknowledgements
CVE-2022-4188 None

CVE-2022-4189 - Chromium: CVE-2022-4189 Insufficient policy enforcement in DevTools

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2022-4189
MITRE
NVD		 CVE Title: Chromium: CVE-2022-4189 Insufficient policy enforcement in DevTools
CVSS:
None
FAQ:

Why is this Chrome CVE included in the Security Update Guide?

The vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable. Please see Security Update Guide Supports CVEs Assigned by Industry Partners for more information.

How can I see the version of the browser?

  1. In your Microsoft Edge browser, click on the 3 dots (...) on the very right-hand side of the window
  2. Click on Help and Feedback
  3. Click on About Microsoft Edge

What is the version information for this release?

Microsoft Edge Version Date Released Based on Chromium Version
108.0.1462.41 12/5/2022 108.0.5359.94

Mitigations:
None
Workarounds:
None
Revision:
1.0    2022-12-05T08:00:00    

Information published.


 Unknown Unknown

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Not Found Not Found Not Found

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2022-4189
Product KB Article Severity Impact Supercedence CVSS Score Set Restart Required
Microsoft Edge (Chromium-based) Release Notes (Security Update) Unknown Unknown None Base: N/A
Temporal: N/A
Vector: N/A
 No

Acknowledgements

CVE ID Acknowledgements
CVE-2022-4189 None

CVE-2022-4190 - Chromium: CVE-2022-4190 Insufficient data validation in Directory

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2022-4190
MITRE
NVD		 CVE Title: Chromium: CVE-2022-4190 Insufficient data validation in Directory
CVSS:
None
FAQ:

Why is this Chrome CVE included in the Security Update Guide?

The vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable. Please see Security Update Guide Supports CVEs Assigned by Industry Partners for more information.

How can I see the version of the browser?

  1. In your Microsoft Edge browser, click on the 3 dots (...) on the very right-hand side of the window
  2. Click on Help and Feedback
  3. Click on About Microsoft Edge

What is the version information for this release?

Microsoft Edge Version Date Released Based on Chromium Version
108.0.1462.41 12/5/2022 108.0.5359.94

Mitigations:
None
Workarounds:
None
Revision:
1.0    2022-12-05T08:00:00    

Information published.


 Unknown Unknown

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Not Found Not Found Not Found

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2022-4190
Product KB Article Severity Impact Supercedence CVSS Score Set Restart Required
Microsoft Edge (Chromium-based) Release Notes (Security Update) Unknown Unknown None Base: N/A
Temporal: N/A
Vector: N/A
 No

Acknowledgements

CVE ID Acknowledgements
CVE-2022-4190 None

CVE-2022-4191 - Chromium: CVE-2022-4191 Use after free in Sign-In

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2022-4191
MITRE
NVD		 CVE Title: Chromium: CVE-2022-4191 Use after free in Sign-In
CVSS:
None
FAQ:

Why is this Chrome CVE included in the Security Update Guide?

The vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable. Please see Security Update Guide Supports CVEs Assigned by Industry Partners for more information.

How can I see the version of the browser?

  1. In your Microsoft Edge browser, click on the 3 dots (...) on the very right-hand side of the window
  2. Click on Help and Feedback
  3. Click on About Microsoft Edge

What is the version information for this release?

Microsoft Edge Version Date Released Based on Chromium Version
108.0.1462.41 12/5/2022 108.0.5359.94

Mitigations:
None
Workarounds:
None
Revision:
1.0    2022-12-05T08:00:00    

Information published.


 Unknown Unknown

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Not Found Not Found Not Found

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2022-4191
Product KB Article Severity Impact Supercedence CVSS Score Set Restart Required
Microsoft Edge (Chromium-based) Release Notes (Security Update) Unknown Unknown None Base: N/A
Temporal: N/A
Vector: N/A
 No

Acknowledgements

CVE ID Acknowledgements
CVE-2022-4191 None

CVE-2022-4192 - Chromium: CVE-2022-4192 Use after free in Live Caption

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2022-4192
MITRE
NVD		 CVE Title: Chromium: CVE-2022-4192 Use after free in Live Caption
CVSS:
None
FAQ:

Why is this Chrome CVE included in the Security Update Guide?

The vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable. Please see Security Update Guide Supports CVEs Assigned by Industry Partners for more information.

How can I see the version of the browser?

  1. In your Microsoft Edge browser, click on the 3 dots (...) on the very right-hand side of the window
  2. Click on Help and Feedback
  3. Click on About Microsoft Edge

What is the version information for this release?

Microsoft Edge Version Date Released Based on Chromium Version
108.0.1462.41 12/5/2022 108.0.5359.94

Mitigations:
None
Workarounds:
None
Revision:
1.0    2022-12-05T08:00:00    

Information published.


 Unknown Unknown

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Not Found Not Found Not Found

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2022-4192
Product KB Article Severity Impact Supercedence CVSS Score Set Restart Required
Microsoft Edge (Chromium-based) Release Notes (Security Update) Unknown Unknown None Base: N/A
Temporal: N/A
Vector: N/A
 No

Acknowledgements

CVE ID Acknowledgements
CVE-2022-4192 None

CVE-2022-4193 - Chromium: CVE-2022-4193 Insufficient policy enforcement in File System API

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2022-4193
MITRE
NVD		 CVE Title: Chromium: CVE-2022-4193 Insufficient policy enforcement in File System API
CVSS:
None
FAQ:

Why is this Chrome CVE included in the Security Update Guide?

The vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable. Please see Security Update Guide Supports CVEs Assigned by Industry Partners for more information.

How can I see the version of the browser?

  1. In your Microsoft Edge browser, click on the 3 dots (...) on the very right-hand side of the window
  2. Click on Help and Feedback
  3. Click on About Microsoft Edge

What is the version information for this release?

Microsoft Edge Version Date Released Based on Chromium Version
108.0.1462.41 12/5/2022 108.0.5359.94

Mitigations:
None
Workarounds:
None
Revision:
1.0    2022-12-05T08:00:00    

Information published.


 Unknown Unknown

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Not Found Not Found Not Found

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2022-4193
Product KB Article Severity Impact Supercedence CVSS Score Set Restart Required
Microsoft Edge (Chromium-based) Release Notes (Security Update) Unknown Unknown None Base: N/A
Temporal: N/A
Vector: N/A
 No

Acknowledgements

CVE ID Acknowledgements
CVE-2022-4193 None

CVE-2022-4194 - Chromium: CVE-2022-4194 Use after free in Accessibility

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2022-4194
MITRE
NVD		 CVE Title: Chromium: CVE-2022-4194 Use after free in Accessibility
CVSS:
None
FAQ:

Why is this Chrome CVE included in the Security Update Guide?

The vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable. Please see Security Update Guide Supports CVEs Assigned by Industry Partners for more information.

How can I see the version of the browser?

  1. In your Microsoft Edge browser, click on the 3 dots (...) on the very right-hand side of the window
  2. Click on Help and Feedback
  3. Click on About Microsoft Edge

What is the version information for this release?

Microsoft Edge Version Date Released Based on Chromium Version
108.0.1462.41 12/5/2022 108.0.5359.94

Mitigations:
None
Workarounds:
None
Revision:
1.0    2022-12-05T08:00:00    

Information published.


 Unknown Unknown

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Not Found Not Found Not Found

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2022-4194
Product KB Article Severity Impact Supercedence CVSS Score Set Restart Required
Microsoft Edge (Chromium-based) Release Notes (Security Update) Unknown Unknown None Base: N/A
Temporal: N/A
Vector: N/A
 No

Acknowledgements

CVE ID Acknowledgements
CVE-2022-4194 None

CVE-2022-4195 - Chromium: CVE-2022-4195 Insufficient policy enforcement in Safe Browsing

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2022-4195
MITRE
NVD		 CVE Title: Chromium: CVE-2022-4195 Insufficient policy enforcement in Safe Browsing
CVSS:
None
FAQ:

Why is this Chrome CVE included in the Security Update Guide?

The vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable. Please see Security Update Guide Supports CVEs Assigned by Industry Partners for more information.

How can I see the version of the browser?

  1. In your Microsoft Edge browser, click on the 3 dots (...) on the very right-hand side of the window
  2. Click on Help and Feedback
  3. Click on About Microsoft Edge

What is the version information for this release?

Microsoft Edge Version Date Released Based on Chromium Version
108.0.1462.41 12/5/2022 108.0.5359.94

Mitigations:
None
Workarounds:
None
Revision:
1.0    2022-12-05T08:00:00    

Information published.


 Unknown Unknown

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Not Found Not Found Not Found

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2022-4195
Product KB Article Severity Impact Supercedence CVSS Score Set Restart Required
Microsoft Edge (Chromium-based) Release Notes (Security Update) Unknown Unknown None Base: N/A
Temporal: N/A
Vector: N/A
 No

Acknowledgements

CVE ID Acknowledgements
CVE-2022-4195 None

CVE-2022-41127 - Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2022-41127
MITRE
NVD		 CVE Title: Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability
CVSS:

CVSS:3.1 8.5/7.4
Base score metrics
Attack VectorNetwork
Attack ComplexityHigh
Privileges RequiredLow
User InteractionNone
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Temporal score metrics
Exploit Code MaturityUnproven
Remediation LevelOfficial Fix
Report ConfidenceConfirmed

FAQ:

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?

Successful exploitation of this vulnerability requires an attacker to prepare the target environment to improve exploit reliability.


According to the CVSS metric, successful exploitation could lead to a scope change (S:C). Can the exploit move from Dynamics NAV to the underlying operating system?

Yes. An attacker who successfully exploited this vulnerability in Dynamics NAV could execute code on the host server in the context of the service account Dynamics has been configured to use.


According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?

The attacker must be authenticated to be able to exploit this vulnerability.


According to the CVSS metric, the attack vector is network (AV:N). What is the target used in the context of the remote code execution?

The Dynamics NAV opened port could be used to connect with the WCF TCP protocol. As an authenticated user, the attacker could attempt to trigger malicious code in the context of the server's account through a network call.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2022-12-13T08:00:00    

Information published.


 Critical Remote Code Execution

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2022-41127
Product KB Article Severity Impact Supercedence CVSS Score Set Restart Required
Dynamics 365 Business Central 2019 Release Wave 2 (On-Premise) 4528706 (Security Update) Critical Remote Code Execution None Base: 8.5
Temporal: 7.4
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
 Maybe
Dynamics 365 Business Central Spring 2019 Update 5021669 (Security Update) Critical Remote Code Execution None Base: 8.5
Temporal: 7.4
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
 Maybe
Microsoft Dynamics 365 Business Central 2020 Release Wave 1 5010910 (Security Update) Critical Remote Code Execution None Base: 8.5
Temporal: 7.4
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
 Maybe
Microsoft Dynamics 365 Business Central 2020 Release Wave 2 5013420 (Security Update) Critical Remote Code Execution None Base: 8.5
Temporal: 7.4
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
 Maybe
Microsoft Dynamics 365 Business Central 2021 Release Wave 1 5019239 (Security Update) Critical Remote Code Execution None Base: 8.5
Temporal: 7.4
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
 Maybe
Microsoft Dynamics 365 Business Central 2021 Release Wave 2 5021670 (Security Update) Critical Remote Code Execution None Base: 8.5
Temporal: 7.4
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
 Maybe
Microsoft Dynamics 365 Business Central 2022 Release Wave 1 5021671 (Security Update) Critical Remote Code Execution None Base: 8.5
Temporal: 7.4
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
 Maybe
Microsoft Dynamics 365 Business Central 2022 Release Wave 2 5021672 (Security Update) Critical Remote Code Execution None Base: 8.5
Temporal: 7.4
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
 Maybe
Microsoft Dynamics NAV 2016 5005293 (Security Update) Critical Remote Code Execution None Base: 8.5
Temporal: 7.4
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
 Maybe
Microsoft Dynamics NAV 2017 5010202 (Security Update) Critical Remote Code Execution None Base: 8.5
Temporal: 7.4
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
 Maybe
Microsoft Dynamics NAV 2018 5021668 (Security Update) Critical Remote Code Execution None Base: 8.5
Temporal: 7.4
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
 Maybe

Acknowledgements

CVE ID Acknowledgements
CVE-2022-41127 Yiming Xiang with NSFOCUS TIANJI LAB

CVE-2022-44666 - Windows Contacts Remote Code Execution Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2022-44666
MITRE
NVD		 CVE Title: Windows Contacts Remote Code Execution Vulnerability
CVSS:

CVSS:3.1 7.8/6.8
Base score metrics
Attack VectorLocal
Attack ComplexityLow
Privileges RequiredNone
User InteractionRequired
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Temporal score metrics
Exploit Code MaturityUnproven
Remediation LevelOfficial Fix
Report ConfidenceConfirmed

FAQ:

According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?

The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally.

For example, when the score indicates that the Attack Vector is Local and User Interaction is Required, this could describe an exploit in which an attacker, through social engineering, convinces a victim to download and open a specially crafted file from a website which leads to a local attack on their computer.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2022-12-13T08:00:00    

Information published.


 Important Remote Code Execution

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2022-44666
Product KB Article Severity Impact Supercedence CVSS Score Set Restart Required
Windows 10 for 32-bit Systems 5021243 (Security Update) Important Remote Code Execution 5019970
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 for x64-based Systems 5021243 (Security Update) Important Remote Code Execution 5019970
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for 32-bit Systems 5021235 (Security Update) Important Remote Code Execution 5019964
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for x64-based Systems 5021235 (Security Update) Important Remote Code Execution 5019964
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for 32-bit Systems 5021237 (Security Update) Important Remote Code Execution 5019966
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for ARM64-based Systems 5021237 (Security Update) Important Remote Code Execution 5019966
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for x64-based Systems 5021237 (Security Update) Important Remote Code Execution 5019966
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 20H2 for 32-bit Systems 5021233 (Security Update) Important Remote Code Execution
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 20H2 for ARM64-based Systems 5021233 (Security Update) Important Remote Code Execution
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 20H2 for x64-based Systems 5021233 (Security Update) Important Remote Code Execution
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H1 for 32-bit Systems 5021233 (Security Update) Important Remote Code Execution 5019959
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H1 for ARM64-based Systems 5021233 (Security Update) Important Remote Code Execution 5019959
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H1 for x64-based Systems 5021233 (Security Update) Important Remote Code Execution 5019959
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for 32-bit Systems 5021233 (Security Update) Important Remote Code Execution
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for ARM64-based Systems 5021233 (Security Update) Important Remote Code Execution
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for x64-based Systems 5021233 (Security Update) Important Remote Code Execution
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for 32-bit Systems 5021233 (Security Update) Important Remote Code Execution
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for ARM64-based Systems 5021233 (Security Update) Important Remote Code Execution
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for x64-based Systems 5021233 (Security Update) Important Remote Code Execution
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 for ARM64-based Systems 5021234 (Security Update) Important Remote Code Execution 5019961
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 for x64-based Systems 5021234 (Security Update) Important Remote Code Execution 5019961
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for ARM64-based Systems 5021255 (Security Update) Important Remote Code Execution 5019980
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for x64-based Systems 5021255 (Security Update) Important Remote Code Execution 5019980
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 7 for 32-bit Systems Service Pack 1 5021291 (Monthly Rollup)
5021288 (Security Only)		 Important Remote Code Execution 5020000
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 7 for x64-based Systems Service Pack 1 5021291 (Monthly Rollup)
5021288 (Security Only)		 Important Remote Code Execution 5020000
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 8.1 for 32-bit systems 5021294 (Monthly Rollup)
5021296 (Security Only)		 Important Remote Code Execution 5020023
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 8.1 for x64-based systems 5021294 (Monthly Rollup)
5021296 (Security Only)		 Important Remote Code Execution 5020023
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows RT 8.1 5021294 (Monthly Rollup) Important Remote Code Execution 5020023
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 5021289 (Monthly Rollup)
5021293 (Security Only)		 Important Remote Code Execution 5020019
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 5021289 (Monthly Rollup)
5021293 (Security Only)		 Important Remote Code Execution 5020019
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for x64-based Systems Service Pack 2 5021289 (Monthly Rollup)
5021293 (Security Only)		 Important Remote Code Execution 5020019
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 5021289 (Monthly Rollup)
5021293 (Security Only)		 Important Remote Code Execution 5020019
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 5021291 (Monthly Rollup)
5021288 (Security Only)		 Important Remote Code Execution 5020000
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 5021291 (Monthly Rollup)
5021288 (Security Only)		 Important Remote Code Execution 5020000
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 5021285 (Monthly Rollup)
5021303 (Security Only)		 Important Remote Code Execution 5020009
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 (Server Core installation) 5021285 (Monthly Rollup)
5021303 (Security Only)		 Important Remote Code Execution 5020009
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 5021294 (Monthly Rollup)
5021296 (Security Only)		 Important Remote Code Execution 5020023
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 (Server Core installation) 5021294 (Monthly Rollup)
5021296 (Security Only)		 Important Remote Code Execution 5020023
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 5021235 (Security Update) Important Remote Code Execution 5019964
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 (Server Core installation) 5021235 (Security Update) Important Remote Code Execution 5019964
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 5021237 (Security Update) Important Remote Code Execution 5019966
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 (Server Core installation) 5021237 (Security Update) Important Remote Code Execution 5019966
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 5021249 (Security Update) Important Remote Code Execution 5019081
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 (Server Core installation) 5021249 (Security Update) Important Remote Code Execution 5019081
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 Datacenter: Azure Edition 5021249 (Security Update) Important Remote Code Execution 5019081
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2022-44666 j00sean

CVE-2022-44667 - Windows Media Remote Code Execution Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2022-44667
MITRE
NVD		 CVE Title: Windows Media Remote Code Execution Vulnerability
CVSS:

CVSS:3.1 7.8/6.8
Base score metrics
Attack VectorLocal
Attack ComplexityLow
Privileges RequiredNone
User InteractionRequired
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Temporal score metrics
Exploit Code MaturityUnproven
Remediation LevelOfficial Fix
Report ConfidenceConfirmed

FAQ:

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?

Exploitation of the vulnerability requires that a user open a specially crafted file.

  • In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file.
  • In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) containing a specially crafted file designed to exploit the vulnerability.

An attacker would have no way to force users to visit the website. Instead, an attacker would have to convince users to click a link, typically by way of an enticement in an email or instant message, and then convince them to open the specially crafted file.


According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?

The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. The vulnerable endpoint is only available over the local VM interface as all external communication is blocked. This means an attacker needs to execute code from the local machine to exploit the vulnerability.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2022-12-13T08:00:00    

Information published.


 Important Remote Code Execution

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2022-44667
Product KB Article Severity Impact Supercedence CVSS Score Set Restart Required
Windows 10 for 32-bit Systems 5021243 (Security Update) Important Remote Code Execution 5019970
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 for x64-based Systems 5021243 (Security Update) Important Remote Code Execution 5019970
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for 32-bit Systems 5021235 (Security Update) Important Remote Code Execution 5019964
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for x64-based Systems 5021235 (Security Update) Important Remote Code Execution 5019964
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for 32-bit Systems 5021237 (Security Update) Important Remote Code Execution 5019966
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for ARM64-based Systems 5021237 (Security Update) Important Remote Code Execution 5019966
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for x64-based Systems 5021237 (Security Update) Important Remote Code Execution 5019966
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 20H2 for 32-bit Systems 5021233 (Security Update) Important Remote Code Execution
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 20H2 for ARM64-based Systems 5021233 (Security Update) Important Remote Code Execution
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 20H2 for x64-based Systems 5021233 (Security Update) Important Remote Code Execution
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H1 for 32-bit Systems 5021233 (Security Update) Important Remote Code Execution 5019959
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H1 for ARM64-based Systems 5021233 (Security Update) Important Remote Code Execution 5019959
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H1 for x64-based Systems 5021233 (Security Update) Important Remote Code Execution 5019959
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for 32-bit Systems 5021233 (Security Update) Important Remote Code Execution
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for ARM64-based Systems 5021233 (Security Update) Important Remote Code Execution
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for x64-based Systems 5021233 (Security Update) Important Remote Code Execution
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for 32-bit Systems 5021233 (Security Update) Important Remote Code Execution
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for ARM64-based Systems 5021233 (Security Update) Important Remote Code Execution
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for x64-based Systems 5021233 (Security Update) Important Remote Code Execution
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 for ARM64-based Systems 5021234 (Security Update) Important Remote Code Execution 5019961
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 for x64-based Systems 5021234 (Security Update) Important Remote Code Execution 5019961
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for ARM64-based Systems 5021255 (Security Update) Important Remote Code Execution 5019980
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for x64-based Systems 5021255 (Security Update) Important Remote Code Execution 5019980
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 7 for 32-bit Systems Service Pack 1 5021291 (Monthly Rollup)
5021288 (Security Only)		 Important Remote Code Execution 5020000
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 7 for x64-based Systems Service Pack 1 5021291 (Monthly Rollup)
5021288 (Security Only)		 Important Remote Code Execution 5020000
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 8.1 for 32-bit systems 5021294 (Monthly Rollup)
5021296 (Security Only)		 Important Remote Code Execution 5020023
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 8.1 for x64-based systems 5021294 (Monthly Rollup)
5021296 (Security Only)		 Important Remote Code Execution 5020023
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows RT 8.1 5021294 (Monthly Rollup) Important Remote Code Execution 5020023
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 5021291 (Monthly Rollup)
5021288 (Security Only)		 Important Remote Code Execution 5020000
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 5021291 (Monthly Rollup)
5021288 (Security Only)		 Important Remote Code Execution 5020000
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 5021285 (Monthly Rollup)
5021303 (Security Only)		 Important Remote Code Execution 5020009
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 (Server Core installation) 5021285 (Monthly Rollup)
5021303 (Security Only)		 Important Remote Code Execution 5020009
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 5021294 (Monthly Rollup)
5021296 (Security Only)		 Important Remote Code Execution 5020023
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 (Server Core installation) 5021294 (Monthly Rollup)
5021296 (Security Only)		 Important Remote Code Execution 5020023
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 5021235 (Security Update) Important Remote Code Execution 5019964
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 (Server Core installation) 5021235 (Security Update) Important Remote Code Execution 5019964
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 5021237 (Security Update) Important Remote Code Execution 5019966
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 (Server Core installation) 5021237 (Security Update) Important Remote Code Execution 5019966
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 5021249 (Security Update) Important Remote Code Execution 5019081
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 (Server Core installation) 5021249 (Security Update) Important Remote Code Execution 5019081
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 Datacenter: Azure Edition 5021249 (Security Update) Important Remote Code Execution 5019081
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2022-44667 Lê Hữu Quang Linh with STAR Labs

CVE-2022-44668 - Windows Media Remote Code Execution Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2022-44668
MITRE
NVD		 CVE Title: Windows Media Remote Code Execution Vulnerability
CVSS:

CVSS:3.1 7.8/6.8
Base score metrics
Attack VectorLocal
Attack ComplexityLow
Privileges RequiredNone
User InteractionRequired
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Temporal score metrics
Exploit Code MaturityUnproven
Remediation LevelOfficial Fix
Report ConfidenceConfirmed

FAQ:

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?

Exploitation of the vulnerability requires that a user open a specially crafted file.

  • In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file.
  • In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) containing a specially crafted file designed to exploit the vulnerability.

An attacker would have no way to force users to visit the website. Instead, an attacker would have to convince users to click a link, typically by way of an enticement in an email or instant message, and then convince them to open the specially crafted file.


According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?

The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. The vulnerable endpoint is only available over the local VM interface as all external communication is blocked. This means an attacker needs to execute code from the local machine to exploit the vulnerability.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2022-12-13T08:00:00    

Information published.


 Important Remote Code Execution

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2022-44668
Product KB Article Severity Impact Supercedence CVSS Score Set Restart Required
Windows 10 for 32-bit Systems 5021243 (Security Update) Important Remote Code Execution 5019970
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 for x64-based Systems 5021243 (Security Update) Important Remote Code Execution 5019970
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for 32-bit Systems 5021235 (Security Update) Important Remote Code Execution 5019964
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for x64-based Systems 5021235 (Security Update) Important Remote Code Execution 5019964
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for 32-bit Systems 5021237 (Security Update) Important Remote Code Execution 5019966
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for ARM64-based Systems 5021237 (Security Update) Important Remote Code Execution 5019966
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for x64-based Systems 5021237 (Security Update) Important Remote Code Execution 5019966
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 20H2 for 32-bit Systems 5021233 (Security Update) Important Remote Code Execution
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 20H2 for ARM64-based Systems 5021233 (Security Update) Important Remote Code Execution
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 20H2 for x64-based Systems 5021233 (Security Update) Important Remote Code Execution
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H1 for 32-bit Systems 5021233 (Security Update) Important Remote Code Execution 5019959
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H1 for ARM64-based Systems 5021233 (Security Update) Important Remote Code Execution 5019959
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H1 for x64-based Systems 5021233 (Security Update) Important Remote Code Execution 5019959
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for 32-bit Systems 5021233 (Security Update) Important Remote Code Execution
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for ARM64-based Systems 5021233 (Security Update) Important Remote Code Execution
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for x64-based Systems 5021233 (Security Update) Important Remote Code Execution
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for 32-bit Systems 5021233 (Security Update) Important Remote Code Execution
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for ARM64-based Systems 5021233 (Security Update) Important Remote Code Execution
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for x64-based Systems 5021233 (Security Update) Important Remote Code Execution
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 for ARM64-based Systems 5021234 (Security Update) Important Remote Code Execution 5019961
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 for x64-based Systems 5021234 (Security Update) Important Remote Code Execution 5019961
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for ARM64-based Systems 5021255 (Security Update) Important Remote Code Execution 5019980
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for x64-based Systems 5021255 (Security Update) Important Remote Code Execution 5019980
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 7 for 32-bit Systems Service Pack 1 5021291 (Monthly Rollup)
5021288 (Security Only)		 Important Remote Code Execution 5020000
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 7 for x64-based Systems Service Pack 1 5021291 (Monthly Rollup)
5021288 (Security Only)		 Important Remote Code Execution 5020000
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 8.1 for 32-bit systems 5021294 (Monthly Rollup)
5021296 (Security Only)		 Important Remote Code Execution 5020023
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 8.1 for x64-based systems 5021294 (Monthly Rollup)
5021296 (Security Only)		 Important Remote Code Execution 5020023
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows RT 8.1 5021294 (Monthly Rollup) Important Remote Code Execution 5020023
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 5021291 (Monthly Rollup)
5021288 (Security Only)		 Important Remote Code Execution 5020000
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 5021291 (Monthly Rollup)
5021288 (Security Only)		 Important Remote Code Execution 5020000
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 5021285 (Monthly Rollup)
5021303 (Security Only)		 Important Remote Code Execution 5020009
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 (Server Core installation) 5021285 (Monthly Rollup)
5021303 (Security Only)		 Important Remote Code Execution 5020009
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 5021294 (Monthly Rollup)
5021296 (Security Only)		 Important Remote Code Execution 5020023
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 (Server Core installation) 5021294 (Monthly Rollup)
5021296 (Security Only)		 Important Remote Code Execution 5020023
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 5021235 (Security Update) Important Remote Code Execution 5019964
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 (Server Core installation) 5021235 (Security Update) Important Remote Code Execution 5019964
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 5021237 (Security Update) Important Remote Code Execution 5019966
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 (Server Core installation) 5021237 (Security Update) Important Remote Code Execution 5019966
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 5021249 (Security Update) Important Remote Code Execution 5019081
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 (Server Core installation) 5021249 (Security Update) Important Remote Code Execution 5019081
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2022-44668 Lê Hữu Quang Linh with STAR Labs

CVE-2022-44673 - Windows Client Server Run-Time Subsystem (CSRSS) Elevation of Privilege Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2022-44673
MITRE
NVD		 CVE Title: Windows Client Server Run-Time Subsystem (CSRSS) Elevation of Privilege Vulnerability
CVSS:

CVSS:3.1 7.0/6.1
Base score metrics
Attack VectorLocal
Attack ComplexityHigh
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Temporal score metrics
Exploit Code MaturityUnproven
Remediation LevelOfficial Fix
Report ConfidenceConfirmed

FAQ:

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?

Successful exploitation of this vulnerability requires an attacker to take additional actions prior to exploitation to prepare the target environment.


What privileges could an attacker gain?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2022-12-13T08:00:00    

Information published.


 Important Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Exploitation More Likely No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2022-44673
Product KB Article Severity Impact Supercedence CVSS Score Set Restart Required
Windows 10 for 32-bit Systems 5021243 (Security Update) Important Elevation of Privilege 5019970
 Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for 32-bit Systems 5021235 (Security Update) Important Elevation of Privilege 5019964
 Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for 32-bit Systems 5021237 (Security Update) Important Elevation of Privilege 5019966
 Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 20H2 for 32-bit Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H1 for 32-bit Systems 5021233 (Security Update) Important Elevation of Privilege 5019959
 Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for 32-bit Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for 32-bit Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 7 for 32-bit Systems Service Pack 1 5021291 (Monthly Rollup)
5021288 (Security Only)		 Important Elevation of Privilege 5020000
 Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 8.1 for 32-bit systems 5021294 (Monthly Rollup)
5021296 (Security Only)		 Important Elevation of Privilege 5020023
 Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 5021289 (Monthly Rollup)
5021293 (Security Only)		 Important Elevation of Privilege 5020019
 Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 5021289 (Monthly Rollup)
5021293 (Security Only)		 Important Elevation of Privilege 5020019
 Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2022-44673 Anonymous

CVE-2022-44674 - Windows Bluetooth Driver Information Disclosure Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2022-44674
MITRE
NVD		 CVE Title: Windows Bluetooth Driver Information Disclosure Vulnerability
CVSS:

CVSS:3.1 5.5/4.8
Base score metrics
Attack VectorLocal
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityNone
AvailabilityNone
Temporal score metrics
Exploit Code MaturityUnproven
Remediation LevelOfficial Fix
Report ConfidenceConfirmed

FAQ:

What type of information could be disclosed by this vulnerability?

The type of information that could be disclosed if an attacker successfully exploited this vulnerability is the contents of Kernel memory. An attacker could read the contents of Kernel memory from a user mode process.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2022-12-13T08:00:00    

Information published.


 Important Information Disclosure

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2022-44674
Product KB Article Severity Impact Supercedence CVSS Score Set Restart Required
Windows 10 Version 1809 for 32-bit Systems 5021237 (Security Update) Important Information Disclosure 5019966
 Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for ARM64-based Systems 5021237 (Security Update) Important Information Disclosure 5019966
 Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for x64-based Systems 5021237 (Security Update) Important Information Disclosure 5019966
 Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 20H2 for 32-bit Systems 5021233 (Security Update) Important Information Disclosure
5019959		 Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 20H2 for ARM64-based Systems 5021233 (Security Update) Important Information Disclosure
5019959		 Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 20H2 for x64-based Systems 5021233 (Security Update) Important Information Disclosure
5019959		 Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H1 for 32-bit Systems 5021233 (Security Update) Important Information Disclosure 5019959
 Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H1 for ARM64-based Systems 5021233 (Security Update) Important Information Disclosure 5019959
 Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H1 for x64-based Systems 5021233 (Security Update) Important Information Disclosure 5019959
 Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for 32-bit Systems 5021233 (Security Update) Important Information Disclosure
5019959		 Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for ARM64-based Systems 5021233 (Security Update) Important Information Disclosure
5019959		 Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for x64-based Systems 5021233 (Security Update) Important Information Disclosure
5019959		 Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for 32-bit Systems 5021233 (Security Update) Important Information Disclosure
5019959		 Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for ARM64-based Systems 5021233 (Security Update) Important Information Disclosure
5019959		 Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for x64-based Systems 5021233 (Security Update) Important Information Disclosure
5019959		 Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 11 for ARM64-based Systems 5021234 (Security Update) Important Information Disclosure 5019961
 Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 11 for x64-based Systems 5021234 (Security Update) Important Information Disclosure 5019961
 Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for ARM64-based Systems 5021255 (Security Update) Important Information Disclosure 5019980
 Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for x64-based Systems 5021255 (Security Update) Important Information Disclosure 5019980
 Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2019 5021237 (Security Update) Important Information Disclosure 5019966
 Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2019 (Server Core installation) 5021237 (Security Update) Important Information Disclosure 5019966
 Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2022 5021249 (Security Update) Important Information Disclosure 5019081
 Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2022 (Server Core installation) 5021249 (Security Update) Important Information Disclosure 5019081
 Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2022 Datacenter: Azure Edition 5021249 (Security Update) Important Information Disclosure 5019081
 Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2022-44674 ziming zhang with Ant Security Light-Year Lab

CVE-2022-44675 - Windows Bluetooth Driver Elevation of Privilege Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2022-44675
MITRE
NVD		 CVE Title: Windows Bluetooth Driver Elevation of Privilege Vulnerability
CVSS:

CVSS:3.1 7.8/6.8
Base score metrics
Attack VectorLocal
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Temporal score metrics
Exploit Code MaturityUnproven
Remediation LevelOfficial Fix
Report ConfidenceConfirmed

FAQ:

What privileges could an attacker gain?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2022-12-13T08:00:00    

Information published.


 Important Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Exploitation More Likely No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2022-44675
Product KB Article Severity Impact Supercedence CVSS Score Set Restart Required
Windows 10 for 32-bit Systems 5021243 (Security Update) Important Elevation of Privilege 5019970
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 for x64-based Systems 5021243 (Security Update) Important Elevation of Privilege 5019970
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for 32-bit Systems 5021235 (Security Update) Important Elevation of Privilege 5019964
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for x64-based Systems 5021235 (Security Update) Important Elevation of Privilege 5019964
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for 32-bit Systems 5021237 (Security Update) Important Elevation of Privilege 5019966
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for ARM64-based Systems 5021237 (Security Update) Important Elevation of Privilege 5019966
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for x64-based Systems 5021237 (Security Update) Important Elevation of Privilege 5019966
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 20H2 for 32-bit Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 20H2 for ARM64-based Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 20H2 for x64-based Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H1 for 32-bit Systems 5021233 (Security Update) Important Elevation of Privilege 5019959
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H1 for ARM64-based Systems 5021233 (Security Update) Important Elevation of Privilege 5019959
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H1 for x64-based Systems 5021233 (Security Update) Important Elevation of Privilege 5019959
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for 32-bit Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for ARM64-based Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for x64-based Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for 32-bit Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for ARM64-based Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for x64-based Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 for ARM64-based Systems 5021234 (Security Update) Important Elevation of Privilege 5019961
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 for x64-based Systems 5021234 (Security Update) Important Elevation of Privilege 5019961
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for ARM64-based Systems 5021255 (Security Update) Important Elevation of Privilege 5019980
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for x64-based Systems 5021255 (Security Update) Important Elevation of Privilege 5019980
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 7 for 32-bit Systems Service Pack 1 5021291 (Monthly Rollup)
5021288 (Security Only)		 Important Elevation of Privilege 5020000
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 7 for x64-based Systems Service Pack 1 5021291 (Monthly Rollup)
5021288 (Security Only)		 Important Elevation of Privilege 5020000
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 8.1 for 32-bit systems 5021294 (Monthly Rollup)
5021296 (Security Only)		 Important Elevation of Privilege 5020023
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 8.1 for x64-based systems 5021294 (Monthly Rollup)
5021296 (Security Only)		 Important Elevation of Privilege 5020023
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows RT 8.1 5021294 (Monthly Rollup) Important Elevation of Privilege 5020023
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 5021291 (Monthly Rollup)
5021288 (Security Only)		 Important Elevation of Privilege 5020000
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 5021291 (Monthly Rollup)
5021288 (Security Only)		 Important Elevation of Privilege 5020000
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 5021285 (Monthly Rollup)
5021303 (Security Only)		 Important Elevation of Privilege 5020009
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 (Server Core installation) 5021285 (Monthly Rollup)
5021303 (Security Only)		 Important Elevation of Privilege 5020009
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 5021294 (Monthly Rollup)
5021296 (Security Only)		 Important Elevation of Privilege 5020023
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 (Server Core installation) 5021294 (Monthly Rollup)
5021296 (Security Only)		 Important Elevation of Privilege 5020023
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 5021235 (Security Update) Important Elevation of Privilege 5019964
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 (Server Core installation) 5021235 (Security Update) Important Elevation of Privilege 5019964
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 5021237 (Security Update) Important Elevation of Privilege 5019966
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 (Server Core installation) 5021237 (Security Update) Important Elevation of Privilege 5019966
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 5021249 (Security Update) Important Elevation of Privilege 5019081
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 (Server Core installation) 5021249 (Security Update) Important Elevation of Privilege 5019081
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 Datacenter: Azure Edition 5021249 (Security Update) Important Elevation of Privilege 5019081
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2022-44675 ziming zhang with Ant Security Light-Year Lab

CVE-2022-44676 - Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2022-44676
MITRE
NVD		 CVE Title: Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
CVSS:

CVSS:3.1 8.1/7.1
Base score metrics
Attack VectorNetwork
Attack ComplexityHigh
Privileges RequiredNone
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Temporal score metrics
Exploit Code MaturityUnproven
Remediation LevelOfficial Fix
Report ConfidenceConfirmed

FAQ:

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?

Successful exploitation of this vulnerability requires an attacker to win a race condition.


How could an attacker exploit this vulnerability?

An unauthenticated attacker could send a specially crafted connection request to a RAS server, which could lead to remote code execution (RCE) on the RAS server machine.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2022-12-13T08:00:00    

Information published.


 Critical Remote Code Execution

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2022-44676
Product KB Article Severity Impact Supercedence CVSS Score Set Restart Required
Windows 10 for 32-bit Systems 5021243 (Security Update) Critical Remote Code Execution 5019970
 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 for x64-based Systems 5021243 (Security Update) Critical Remote Code Execution 5019970
 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for 32-bit Systems 5021235 (Security Update) Critical Remote Code Execution 5019964
 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for x64-based Systems 5021235 (Security Update) Critical Remote Code Execution 5019964
 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for 32-bit Systems 5021237 (Security Update) Critical Remote Code Execution 5019966
 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for ARM64-based Systems 5021237 (Security Update) Critical Remote Code Execution 5019966
 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for x64-based Systems 5021237 (Security Update) Critical Remote Code Execution 5019966
 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 20H2 for 32-bit Systems 5021233 (Security Update) Critical Remote Code Execution
5019959		 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 20H2 for ARM64-based Systems 5021233 (Security Update) Critical Remote Code Execution
5019959		 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 20H2 for x64-based Systems 5021233 (Security Update) Critical Remote Code Execution
5019959		 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H1 for 32-bit Systems 5021233 (Security Update) Critical Remote Code Execution 5019959
 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H1 for ARM64-based Systems 5021233 (Security Update) Critical Remote Code Execution 5019959
 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H1 for x64-based Systems 5021233 (Security Update) Critical Remote Code Execution 5019959
 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for 32-bit Systems 5021233 (Security Update) Critical Remote Code Execution
5019959		 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for ARM64-based Systems 5021233 (Security Update) Critical Remote Code Execution
5019959		 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for x64-based Systems 5021233 (Security Update) Critical Remote Code Execution
5019959		 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for 32-bit Systems 5021233 (Security Update) Critical Remote Code Execution
5019959		 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for ARM64-based Systems 5021233 (Security Update) Critical Remote Code Execution
5019959		 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for x64-based Systems 5021233 (Security Update) Critical Remote Code Execution
5019959		 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 for ARM64-based Systems 5021234 (Security Update) Critical Remote Code Execution 5019961
 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 for x64-based Systems 5021234 (Security Update) Critical Remote Code Execution 5019961
 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for ARM64-based Systems 5021255 (Security Update) Critical Remote Code Execution 5019980
 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for x64-based Systems 5021255 (Security Update) Critical Remote Code Execution 5019980
 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 7 for 32-bit Systems Service Pack 1 5021291 (Monthly Rollup)
5021288 (Security Only)		 Critical Remote Code Execution 5020000
 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 7 for x64-based Systems Service Pack 1 5021291 (Monthly Rollup)
5021288 (Security Only)		 Critical Remote Code Execution 5020000
 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 8.1 for 32-bit systems 5021294 (Monthly Rollup)
5021296 (Security Only)		 Critical Remote Code Execution 5020023
 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 8.1 for x64-based systems 5021294 (Monthly Rollup)
5021296 (Security Only)		 Critical Remote Code Execution 5020023
 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows RT 8.1 5021294 (Monthly Rollup) Critical Remote Code Execution 5020023
 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 5021289 (Monthly Rollup)
5021293 (Security Only)		 Critical Remote Code Execution 5020019
 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 5021289 (Monthly Rollup)
5021293 (Security Only)		 Critical Remote Code Execution 5020019
 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for x64-based Systems Service Pack 2 5021289 (Monthly Rollup)
5021293 (Security Only)		 Critical Remote Code Execution 5020019
 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 5021289 (Monthly Rollup)
5021293 (Security Only)		 Critical Remote Code Execution 5020019
 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 5021291 (Monthly Rollup)
5021288 (Security Only)		 Critical Remote Code Execution 5020000
 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 5021291 (Monthly Rollup)
5021288 (Security Only)		 Critical Remote Code Execution 5020000
 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 5021285 (Monthly Rollup)
5021303 (Security Only)		 Critical Remote Code Execution 5020009
 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 (Server Core installation) 5021285 (Monthly Rollup)
5021303 (Security Only)		 Critical Remote Code Execution 5020009
 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 5021294 (Monthly Rollup)
5021296 (Security Only)		 Critical Remote Code Execution 5020023
 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 (Server Core installation) 5021294 (Monthly Rollup)
5021296 (Security Only)		 Critical Remote Code Execution 5020023
 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 5021235 (Security Update) Critical Remote Code Execution 5019964
 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 (Server Core installation) 5021235 (Security Update) Critical Remote Code Execution 5019964
 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 5021237 (Security Update) Critical Remote Code Execution 5019966
 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 (Server Core installation) 5021237 (Security Update) Critical Remote Code Execution 5019966
 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 5021249 (Security Update) Critical Remote Code Execution 5019081
 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 (Server Core installation) 5021249 (Security Update) Critical Remote Code Execution 5019081
 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 Datacenter: Azure Edition 5021249 (Security Update) Critical Remote Code Execution 5019081
 Base: 8.1
Temporal: 7.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2022-44676 Yuki Chen with Cyber KunLun

CVE-2022-44677 - Windows Projected File System Elevation of Privilege Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2022-44677
MITRE
NVD		 CVE Title: Windows Projected File System Elevation of Privilege Vulnerability
CVSS:

CVSS:3.1 7.8/6.8
Base score metrics
Attack VectorLocal
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Temporal score metrics
Exploit Code MaturityUnproven
Remediation LevelOfficial Fix
Report ConfidenceConfirmed

FAQ:

According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?

Any authenticated user could trigger this vulnerability. It does not require admin or other elevated privileges.


What privileges could an attacker gain?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2022-12-13T08:00:00    

Information published.


 Important Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2022-44677
Product KB Article Severity Impact Supercedence CVSS Score Set Restart Required
Windows 10 Version 1809 for 32-bit Systems 5021237 (Security Update) Important Elevation of Privilege 5019966
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for ARM64-based Systems 5021237 (Security Update) Important Elevation of Privilege 5019966
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for x64-based Systems 5021237 (Security Update) Important Elevation of Privilege 5019966
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 20H2 for 32-bit Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 20H2 for ARM64-based Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 20H2 for x64-based Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H1 for 32-bit Systems 5021233 (Security Update) Important Elevation of Privilege 5019959
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H1 for ARM64-based Systems 5021233 (Security Update) Important Elevation of Privilege 5019959
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H1 for x64-based Systems 5021233 (Security Update) Important Elevation of Privilege 5019959
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for 32-bit Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for ARM64-based Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for x64-based Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for 32-bit Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for ARM64-based Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for x64-based Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 for ARM64-based Systems 5021234 (Security Update) Important Elevation of Privilege 5019961
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 for x64-based Systems 5021234 (Security Update) Important Elevation of Privilege 5019961
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for ARM64-based Systems 5021255 (Security Update) Important Elevation of Privilege 5019980
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for x64-based Systems 5021255 (Security Update) Important Elevation of Privilege 5019980
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 5021237 (Security Update) Important Elevation of Privilege 5019966
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 (Server Core installation) 5021237 (Security Update) Important Elevation of Privilege 5019966
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 5021249 (Security Update) Important Elevation of Privilege 5019081
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 (Server Core installation) 5021249 (Security Update) Important Elevation of Privilege 5019081
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 Datacenter: Azure Edition 5021249 (Security Update) Unknown Unknown 5019081
 Base: N/A
Temporal: N/A
Vector: N/A
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2022-44677 k0shl with Kunlun Lab

CVE-2022-44678 - Windows Print Spooler Elevation of Privilege Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2022-44678
MITRE
NVD		 CVE Title: Windows Print Spooler Elevation of Privilege Vulnerability
CVSS:

CVSS:3.1 7.8/6.8
Base score metrics
Attack VectorLocal
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Temporal score metrics
Exploit Code MaturityUnproven
Remediation LevelOfficial Fix
Report ConfidenceConfirmed

FAQ:

What privileges could an attacker gain?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2022-12-13T08:00:00    

Information published.


 Important Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2022-44678
Product KB Article Severity Impact Supercedence CVSS Score Set Restart Required
Windows 10 for 32-bit Systems 5021243 (Security Update) Important Elevation of Privilege 5019970
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 for x64-based Systems 5021243 (Security Update) Important Elevation of Privilege 5019970
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for 32-bit Systems 5021235 (Security Update) Important Elevation of Privilege 5019964
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for x64-based Systems 5021235 (Security Update) Important Elevation of Privilege 5019964
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for 32-bit Systems 5021237 (Security Update) Important Elevation of Privilege 5019966
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for ARM64-based Systems 5021237 (Security Update) Important Elevation of Privilege 5019966
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for x64-based Systems 5021237 (Security Update) Important Elevation of Privilege 5019966
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 20H2 for 32-bit Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 20H2 for ARM64-based Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 20H2 for x64-based Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H1 for 32-bit Systems 5021233 (Security Update) Important Elevation of Privilege 5019959
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H1 for ARM64-based Systems 5021233 (Security Update) Important Elevation of Privilege 5019959
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H1 for x64-based Systems 5021233 (Security Update) Important Elevation of Privilege 5019959
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for 32-bit Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for ARM64-based Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for x64-based Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for 32-bit Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for ARM64-based Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for x64-based Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 for ARM64-based Systems 5021234 (Security Update) Important Elevation of Privilege 5019961
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 for x64-based Systems 5021234 (Security Update) Important Elevation of Privilege 5019961
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for ARM64-based Systems 5021255 (Security Update) Important Elevation of Privilege 5019980
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for x64-based Systems 5021255 (Security Update) Important Elevation of Privilege 5019980
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 7 for 32-bit Systems Service Pack 1 5021291 (Monthly Rollup)
5021288 (Security Only)		 Important Elevation of Privilege 5020000
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 7 for x64-based Systems Service Pack 1 5021291 (Monthly Rollup)
5021288 (Security Only)		 Important Elevation of Privilege 5020000
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 8.1 for 32-bit systems 5021294 (Monthly Rollup)
5021296 (Security Only)		 Important Elevation of Privilege 5020023
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 8.1 for x64-based systems 5021294 (Monthly Rollup)
5021296 (Security Only)		 Important Elevation of Privilege 5020023
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows RT 8.1 5021294 (Monthly Rollup) Important Elevation of Privilege 5020023
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 5021289 (Monthly Rollup)
5021293 (Security Only)		 Important Elevation of Privilege 5020019
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 5021289 (Monthly Rollup)
5021293 (Security Only)		 Important Elevation of Privilege 5020019
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for x64-based Systems Service Pack 2 5021289 (Monthly Rollup)
5021293 (Security Only)		 Important Elevation of Privilege 5020019
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 5021289 (Monthly Rollup)
5021293 (Security Only)		 Important Elevation of Privilege 5020019
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 5021291 (Monthly Rollup)
5021288 (Security Only)		 Important Elevation of Privilege 5020000
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 5021291 (Monthly Rollup)
5021288 (Security Only)		 Important Elevation of Privilege 5020000
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 5021285 (Monthly Rollup)
5021303 (Security Only)		 Important Elevation of Privilege 5020009
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 (Server Core installation) 5021285 (Monthly Rollup)
5021303 (Security Only)		 Important Elevation of Privilege 5020009
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 5021294 (Monthly Rollup)
5021296 (Security Only)		 Important Elevation of Privilege 5020023
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 (Server Core installation) 5021294 (Monthly Rollup)
5021296 (Security Only)		 Important Elevation of Privilege 5020023
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 5021235 (Security Update) Important Elevation of Privilege 5019964
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 (Server Core installation) 5021235 (Security Update) Important Elevation of Privilege 5019964
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 5021237 (Security Update) Important Elevation of Privilege 5019966
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 (Server Core installation) 5021237 (Security Update) Important Elevation of Privilege 5019966
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 5021249 (Security Update) Important Elevation of Privilege 5019081
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 (Server Core installation) 5021249 (Security Update) Important Elevation of Privilege 5019081
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 Datacenter: Azure Edition 5021249 (Security Update) Important Elevation of Privilege 5019081
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2022-44678 l1nk3d, renyimen, and lm0963 with TIANGONG Team of Legendsec at Qi'anxin Group

CVE-2022-44679 - Windows Graphics Component Information Disclosure Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2022-44679
MITRE
NVD		 CVE Title: Windows Graphics Component Information Disclosure Vulnerability
CVSS:

CVSS:3.1 6.5/5.7
Base score metrics
Attack VectorLocal
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeChanged
ConfidentialityHigh
IntegrityNone
AvailabilityNone
Temporal score metrics
Exploit Code MaturityUnproven
Remediation LevelOfficial Fix
Report ConfidenceConfirmed

FAQ:

What type of information could be disclosed by this vulnerability?

Exploiting this vulnerability could allow the disclosure of initialized or uninitialized memory in the process heap.


According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?

In this case, a successful attack could be performed from a low privilege AppContainer. The attacker could get unauthorized access to sensitive user data outside of the AppContainer execution environment.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2022-12-13T08:00:00    

Information published.


 Important Information Disclosure

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2022-44679
Product KB Article Severity Impact Supercedence CVSS Score Set Restart Required
Windows 10 for 32-bit Systems 5021243 (Security Update) Important Information Disclosure 5019970
 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 for x64-based Systems 5021243 (Security Update) Important Information Disclosure 5019970
 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for 32-bit Systems 5021235 (Security Update) Important Information Disclosure 5019964
 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for x64-based Systems 5021235 (Security Update) Important Information Disclosure 5019964
 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for 32-bit Systems 5021237 (Security Update) Important Information Disclosure 5019966
 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for ARM64-based Systems 5021237 (Security Update) Important Information Disclosure 5019966
 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for x64-based Systems 5021237 (Security Update) Important Information Disclosure 5019966
 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 20H2 for 32-bit Systems 5021233 (Security Update) Important Information Disclosure
5019959		 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 20H2 for ARM64-based Systems 5021233 (Security Update) Important Information Disclosure
5019959		 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 20H2 for x64-based Systems 5021233 (Security Update) Important Information Disclosure
5019959		 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H1 for 32-bit Systems 5021233 (Security Update) Important Information Disclosure 5019959
 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H1 for ARM64-based Systems 5021233 (Security Update) Important Information Disclosure 5019959
 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H1 for x64-based Systems 5021233 (Security Update) Important Information Disclosure 5019959
 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for 32-bit Systems 5021233 (Security Update) Important Information Disclosure
5019959		 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for ARM64-based Systems 5021233 (Security Update) Important Information Disclosure
5019959		 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for x64-based Systems 5021233 (Security Update) Important Information Disclosure
5019959		 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for 32-bit Systems 5021233 (Security Update) Important Information Disclosure
5019959		 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for ARM64-based Systems 5021233 (Security Update) Important Information Disclosure
5019959		 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for x64-based Systems 5021233 (Security Update) Important Information Disclosure
5019959		 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 11 for ARM64-based Systems 5021234 (Security Update) Important Information Disclosure 5019961
 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 11 for x64-based Systems 5021234 (Security Update) Important Information Disclosure 5019961
 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for ARM64-based Systems 5021255 (Security Update) Important Information Disclosure 5019980
 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for x64-based Systems 5021255 (Security Update) Important Information Disclosure 5019980
 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 8.1 for 32-bit systems 5021294 (Monthly Rollup)
5021296 (Security Only)		 Important Information Disclosure 5020023
 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 8.1 for x64-based systems 5021294 (Monthly Rollup)
5021296 (Security Only)		 Important Information Disclosure 5020023
 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows RT 8.1 5021294 (Monthly Rollup) Important Information Disclosure 5020023
 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2012 5021285 (Monthly Rollup)
5021303 (Security Only)		 Important Information Disclosure 5020009
 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2012 (Server Core installation) 5021285 (Monthly Rollup)
5021303 (Security Only)		 Important Information Disclosure 5020009
 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 5021294 (Monthly Rollup)
5021296 (Security Only)		 Important Information Disclosure 5020023
 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 (Server Core installation) 5021294 (Monthly Rollup)
5021296 (Security Only)		 Important Information Disclosure 5020023
 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2016 5021235 (Security Update) Important Information Disclosure 5019964
 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2016 (Server Core installation) 5021235 (Security Update) Important Information Disclosure 5019964
 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2019 5021237 (Security Update) Important Information Disclosure 5019966
 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2019 (Server Core installation) 5021237 (Security Update) Important Information Disclosure 5019966
 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2022 5021249 (Security Update) Important Information Disclosure 5019081
 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2022 (Server Core installation) 5021249 (Security Update) Important Information Disclosure 5019081
 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2022 Datacenter: Azure Edition 5021249 (Security Update) Important Information Disclosure 5019081
 Base: 6.5
Temporal: 5.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2022-44679 lm0963, renyimen, and l1nk3d with TianGong Team of Legendsec at Qi'anxin Group


CVE-2022-44680 - Windows Graphics Component Elevation of Privilege Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2022-44680
MITRE
NVD		 CVE Title: Windows Graphics Component Elevation of Privilege Vulnerability
CVSS:

CVSS:3.1 7.8/6.8
Base score metrics
Attack VectorLocal
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Temporal score metrics
Exploit Code MaturityUnproven
Remediation LevelOfficial Fix
Report ConfidenceConfirmed

FAQ:

What privileges could an attacker gain?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2022-12-13T08:00:00    

Information published.


 Important Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2022-44680
Product KB Article Severity Impact Supercedence CVSS Score Set Restart Required
Windows 10 for 32-bit Systems 5021243 (Security Update) Important Elevation of Privilege 5019970
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 for x64-based Systems 5021243 (Security Update) Important Elevation of Privilege 5019970
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for 32-bit Systems 5021235 (Security Update) Important Elevation of Privilege 5019964
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for x64-based Systems 5021235 (Security Update) Important Elevation of Privilege 5019964
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for 32-bit Systems 5021237 (Security Update) Important Elevation of Privilege 5019966
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for ARM64-based Systems 5021237 (Security Update) Important Elevation of Privilege 5019966
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for x64-based Systems 5021237 (Security Update) Important Elevation of Privilege 5019966
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 20H2 for 32-bit Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 20H2 for ARM64-based Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 20H2 for x64-based Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H1 for 32-bit Systems 5021233 (Security Update) Important Elevation of Privilege 5019959
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H1 for ARM64-based Systems 5021233 (Security Update) Important Elevation of Privilege 5019959
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H1 for x64-based Systems 5021233 (Security Update) Important Elevation of Privilege 5019959
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for 32-bit Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for ARM64-based Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for x64-based Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for 32-bit Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for ARM64-based Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for x64-based Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 for ARM64-based Systems 5021234 (Security Update) Important Elevation of Privilege 5019961
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 for x64-based Systems 5021234 (Security Update) Important Elevation of Privilege 5019961
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for ARM64-based Systems 5021255 (Security Update) Important Elevation of Privilege 5019980
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for x64-based Systems 5021255 (Security Update) Important Elevation of Privilege 5019980
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 8.1 for 32-bit systems 5021294 (Monthly Rollup)
5021296 (Security Only)		 Important Elevation of Privilege 5020023
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 8.1 for x64-based systems 5021294 (Monthly Rollup)
5021296 (Security Only)		 Important Elevation of Privilege 5020023
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows RT 8.1 5021294 (Monthly Rollup) Important Elevation of Privilege 5020023
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 5021285 (Monthly Rollup)
5021303 (Security Only)		 Important Elevation of Privilege 5020009
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 (Server Core installation) 5021285 (Monthly Rollup)
5021303 (Security Only)		 Important Elevation of Privilege 5020009
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 5021294 (Monthly Rollup)
5021296 (Security Only)		 Important Elevation of Privilege 5020023
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 (Server Core installation) 5021294 (Monthly Rollup)
5021296 (Security Only)		 Important Elevation of Privilege 5020023
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 5021235 (Security Update) Important Elevation of Privilege 5019964
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 (Server Core installation) 5021235 (Security Update) Important Elevation of Privilege 5019964
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 5021237 (Security Update) Important Elevation of Privilege 5019966
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 (Server Core installation) 5021237 (Security Update) Important Elevation of Privilege 5019966
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 5021249 (Security Update) Important Elevation of Privilege 5019081
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 (Server Core installation) 5021249 (Security Update) Important Elevation of Privilege 5019081
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 Datacenter: Azure Edition 5021249 (Security Update) Important Elevation of Privilege 5019081
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2022-44680 lm0963, renyimen, and l1nk3d with TianGong Team of Legendsec at Qi'anxin Group


CVE-2022-44681 - Windows Print Spooler Elevation of Privilege Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2022-44681
MITRE
NVD		 CVE Title: Windows Print Spooler Elevation of Privilege Vulnerability
CVSS:

CVSS:3.1 7.8/6.8
Base score metrics
Attack VectorLocal
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
Temporal score metrics
Exploit Code MaturityUnproven
Remediation LevelOfficial Fix
Report ConfidenceConfirmed

FAQ:

What privileges could an attacker gain?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2022-12-13T08:00:00    

Information published.


 Important Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Exploitation Unlikely No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2022-44681
Product KB Article Severity Impact Supercedence CVSS Score Set Restart Required
Windows 10 for 32-bit Systems 5021243 (Security Update) Important Elevation of Privilege 5019970
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 for x64-based Systems 5021243 (Security Update) Important Elevation of Privilege 5019970
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for 32-bit Systems 5021235 (Security Update) Important Elevation of Privilege 5019964
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for x64-based Systems 5021235 (Security Update) Important Elevation of Privilege 5019964
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for 32-bit Systems 5021237 (Security Update) Important Elevation of Privilege 5019966
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for ARM64-based Systems 5021237 (Security Update) Important Elevation of Privilege 5019966
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for x64-based Systems 5021237 (Security Update) Important Elevation of Privilege 5019966
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 20H2 for 32-bit Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 20H2 for ARM64-based Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 20H2 for x64-based Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H1 for 32-bit Systems 5021233 (Security Update) Important Elevation of Privilege 5019959
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H1 for ARM64-based Systems 5021233 (Security Update) Important Elevation of Privilege 5019959
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H1 for x64-based Systems 5021233 (Security Update) Important Elevation of Privilege 5019959
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for 32-bit Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for ARM64-based Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for x64-based Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for 32-bit Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for ARM64-based Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for x64-based Systems 5021233 (Security Update) Important Elevation of Privilege
5019959		 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 for ARM64-based Systems 5021234 (Security Update) Important Elevation of Privilege 5019961
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 for x64-based Systems 5021234 (Security Update) Important Elevation of Privilege 5019961
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for ARM64-based Systems 5021255 (Security Update) Important Elevation of Privilege 5019980
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for x64-based Systems 5021255 (Security Update) Important Elevation of Privilege 5019980
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 7 for 32-bit Systems Service Pack 1 5021291 (Monthly Rollup)
5021288 (Security Only)		 Important Elevation of Privilege 5020000
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 7 for x64-based Systems Service Pack 1 5021291 (Monthly Rollup)
5021288 (Security Only)		 Important Elevation of Privilege 5020000
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 8.1 for 32-bit systems 5021294 (Monthly Rollup)
5021296 (Security Only)		 Important Elevation of Privilege 5020023
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 8.1 for x64-based systems 5021294 (Monthly Rollup)
5021296 (Security Only)		 Important Elevation of Privilege 5020023
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows RT 8.1 5021294 (Monthly Rollup) Important Elevation of Privilege 5020023
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 5021289 (Monthly Rollup)
5021293 (Security Only)		 Important Elevation of Privilege 5020019
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 5021289 (Monthly Rollup)
5021293 (Security Only)		 Important Elevation of Privilege 5020019
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for x64-based Systems Service Pack 2 5021289 (Monthly Rollup)
5021293 (Security Only)		 Important Elevation of Privilege 5020019
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 5021289 (Monthly Rollup)
5021293 (Security Only)		 Important Elevation of Privilege 5020019
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 5021291 (Monthly Rollup)
5021288 (Security Only)		 Important Elevation of Privilege 5020000
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 5021291 (Monthly Rollup)
5021288 (Security Only)		 Important Elevation of Privilege 5020000
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 5021285 (Monthly Rollup)
5021303 (Security Only)		 Important Elevation of Privilege 5020009
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 (Server Core installation) 5021285 (Monthly Rollup)
5021303 (Security Only)		 Important Elevation of Privilege 5020009
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 5021294 (Monthly Rollup)
5021296 (Security Only)		 Important Elevation of Privilege 5020023
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 (Server Core installation) 5021294 (Monthly Rollup)
5021296 (Security Only)		 Important Elevation of Privilege 5020023
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 5021235 (Security Update) Important Elevation of Privilege 5019964
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 (Server Core installation) 5021235 (Security Update) Important Elevation of Privilege 5019964
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 5021237 (Security Update) Important Elevation of Privilege 5019966
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 (Server Core installation) 5021237 (Security Update) Important Elevation of Privilege 5019966
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 5021249 (Security Update) Important Elevation of Privilege 5019081
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 (Server Core installation) 5021249 (Security Update) Important Elevation of Privilege 5019081
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 Datacenter: Azure Edition 5021249 (Security Update) Important Elevation of Privilege 5019081
 Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2022-44681 lm0963, l1nk3d and renyimen with From TianGong Team of Legendsec at Qi'anxin Group

CVE-2022-44682 - Windows Hyper-V Denial of Service Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2022-44682
MITRE
NVD		 CVE Title: Windows Hyper-V Denial of Service Vulnerability
CVSS:

CVSS:3.1 6.8/5.9
Base score metrics
Attack VectorAdjacent
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeChanged
ConfidentialityNone
IntegrityNone
AvailabilityHigh
Temporal score metrics
Exploit Code MaturityUnproven
Remediation LevelOfficial Fix
Report ConfidenceConfirmed

FAQ:

According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?

Successful exploitation of this vulnerability could allow a Hyper-V guest to affect the functionality of the Hyper-V host.


According to the CVSS metric, the Hyper-V attack vector is adjacent (AV:A). What does that mean for this vulnerability?

Where the attack vector metric is Adjacent (A), this represents virtual machines connected via a Hyper-V Network Virtualization (HNV) logical network. This configuration forms an isolation boundary where the virtual machines within the virtual network can only communicate with each other. In this attack vector, the vulnerable component is bound to the network stack, but the attack is limited to systems configured to use the HNV network.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2022-12-13T08:00:00    

Information published.


 Important Denial of Service

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2022-44682
Product KB Article Severity Impact Supercedence CVSS Score Set Restart Required
Windows 10 for x64-based Systems 5021243 (Security Update) Important Denial of Service 5019970
 Base: 6.8
Temporal: 5.9
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for x64-based Systems 5021235 (Security Update) Important Denial of Service 5019964
 Base: 6.8
Temporal: 5.9
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for x64-based Systems 5021237 (Security Update) Important Denial of Service 5019966
 Base: 6.8
Temporal: 5.9
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 20H2 for x64-based Systems 5021233 (Security Update) Important Denial of Service
5019959		 Base: 6.8
Temporal: 5.9
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H1 for x64-based Systems 5021233 (Security Update) Important Denial of Service 5019959
 Base: 6.8
Temporal: 5.9
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for x64-based Systems 5021233 (Security Update) Important Denial of Service
5019959		 Base: 6.8
Temporal: 5.9
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for x64-based Systems 5021233 (Security Update) Important Denial of Service
5019959		 Base: 6.8
Temporal: 5.9
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 for x64-based Systems 5021234 (Security Update) Important Denial of Service 5019961
 Base: 6.8
Temporal: 5.9
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for x64-based Systems 5021255 (Security Update) Important Denial of Service 5019980
 Base: 6.8
Temporal: 5.9
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows 8.1 for x64-based systems 5021294 (Monthly Rollup)
5021296 (Security Only)		 Important Denial of Service 5020023
 Base: 6.8
Temporal: 5.9
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 5021285 (Monthly Rollup)
5021303 (Security Only)		 Important Denial of Service 5020009
 Base: 6.8
Temporal: 5.9
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 (Server Core installation) 5021285 (Monthly Rollup)
5021303 (Security Only)		 Important Denial of Service 5020009
 Base: 6.8
Temporal: 5.9
Vector: CVSS:3