Summary
Impact: Denial of Service. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
According to the CVSS metrics, successful exploitation of this vulnerability could lead to minor loss of confidentiality (C:L), integrity (I:L) and availability (A:L). What does that mean for this vulnerability?
While we cannot rule out the impact to Confidentiality, Integrity, and Availability, the ability to exploit this vulnerability by itself is limited. An attacker can force a bad response to be cached into a regular URL by having multiple occurrences of the same variable in the query string. The impact depends on the business logic of the user application.
Security updates
10.0.17763.3165 — https://support.microsoft.com/help/5015811
10.0.19043.1826 — https://support.microsoft.com/help/5015807
10.0.20348.825 — https://support.microsoft.com/help/5015827
10.0.22000.795 — https://support.microsoft.com/help/5015814
10.0.10240.19360 — https://support.microsoft.com/help/5015832
10.0.14393.5246 — https://support.microsoft.com/help/5015808
6.1.7601.26022 — https://support.microsoft.com/help/5015861
6.1.7601.26022 — https://support.microsoft.com/help/5015862
6.3.9600.20478 — https://support.microsoft.com/help/5015874
6.3.9600.20478 — https://support.microsoft.com/help/5015877
6.0.6003.21569 — https://support.microsoft.com/help/5015866
6.0.6003.21569 — https://support.microsoft.com/help/5015870
6.2.9200.23771 — https://support.microsoft.com/help/5015863
6.2.9200.23771 — https://support.microsoft.com/help/5015875
Vulnerabilities 1
-
High 7.3
Internet Information Services Dynamic Compression Module Denial of Service Vulnerability
Internet Information Services Dynamic Compression Module Denial of Service Vulnerability
Revision history
-
#1
Information published.
References
-
CVE-2022-22040 Internet Information Services Dynamic Compression Module Denial of Service Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22040
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss