MSRC-CVE-2022-22005 — Microsoft SharePoint Server Remote Code Execution Vulnerability

Summary

Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation More Likely. Customer action: Required.

Details

According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?
The attacker must be authenticated and possess the permissions for page creation to be able to exploit this vulnerability.

Security updates
16.0.5278.1000 — https://support.microsoft.com/kb/5002136
15.0.5423.1000 — https://support.microsoft.com/kb/5002120
16.0.10383.20001 — https://support.microsoft.com/kb/5002135
16.0.14326.20742 — https://support.microsoft.com/help/5002145

Vulnerabilities 1

High 8.8

CVE-2022-22005 EPSS 17%

Microsoft SharePoint Server Remote Code Execution Vulnerability

Microsoft SharePoint Server Remote Code Execution Vulnerability

Microsoft Microsoft SharePoint Server 2019 Microsoft SharePoint Enterprise Server 2016 Microsoft SharePoint Server Subscription Edition

Feb 9, 2022

Revision history

2022-02-08 #1
Information published.

References

CVE-2022-22005 Microsoft SharePoint Server Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22005
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss