Summary
Impact: Information Disclosure. Microsoft rating: Important. Not known to be exploited — Exploitation More Likely. Customer action: Required.
Details
What type of information could be disclosed by this vulnerability?
The type of information that could be disclosed if an attacker successfully exploited this vulnerability is unauthorized file system access - reading from the file system.
How could an attacker exploit this vulnerability?
An attacker could exploit this vulnerability by convincing a user to click a specially crafted link. The vulnerable system could then send attacker-specified files, to which the targeted user has access, across the network to a remote system.
Security updates
10.0.19043.2130 — https://support.microsoft.com/help/5018410
10.0.22000.1098 — https://support.microsoft.com/help/5018418
10.0.22621.674 — https://support.microsoft.com/help/5018427
Vulnerabilities 1
-
Medium 6.5CVE-2022-37974 EPSS 36%
Windows Mixed Reality Developer Tools Information Disclosure Vulnerability
Windows Mixed Reality Developer Tools Information Disclosure Vulnerability
Revision history
-
#1
Information published.
References
-
CVE-2022-37974 Windows Mixed Reality Developer Tools Information Disclosure Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37974
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss