Summary
Impact: Remote Code Execution. Microsoft rating: Critical. Exploited according to Microsoft — Exploitation Detected. Customer action: Required.
Details
The CVE title says Windows Scripting Languages, what does that mean for this vulnerability?
This vulnerability impacts the JScript9 scripting language.
According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
This vulnerability requires that a user with an affected version of Windows access a malicious server. An attacker would have to host a specially crafted server share or website. An attacker would have no way to force users to visit this specially crafted server share or website, but would have to convince them to visit the server share or website, typically by way of an enticement in an email or chat message.
Security updates
10.0.17763.3650 — https://support.microsoft.com/help/5019966
10.0.19043.2251 — https://support.microsoft.com/help/5019959
10.0.20348.1249 — https://support.microsoft.com/help/5019081
10.0.20348.1251 — https://support.microsoft.com/help/5019080
10.0.22000.1219 — https://support.microsoft.com/help/5019961
10.0.22621.819 — https://support.microsoft.com/help/5019980
10.0.10240.19567 — https://support.microsoft.com/help/5019970
10.0.14393.5501 — https://support.microsoft.com/help/5019964
6.1.7601.26221 — https://support.microsoft.com/help/5020000
6.1.7601.26221 — https://support.microsoft.com/help/5020013
6.1.7601.26221 — https://support.microsoft.com/help/5019958
6.3.9600.20671 — https://support.microsoft.com/help/5020023
6.3.9600.20670 — https://support.microsoft.com/help/5020010
6.2.9200.23968 — https://support.microsoft.com/help/5020009
6.2.9200.23968 — https://support.microsoft.com/help/5020003
Vulnerabilities 1
-
High 8.8
Windows Scripting Languages Remote Code Execution Vulnerability
Windows Scripting Languages Remote Code Execution Vulnerability
KEV Nov 8, 2022
Revision history
-
#1
Information published.
References
-
CVE-2022-41128 Windows Scripting Languages Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41128
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss