CVE-2022-22005: Microsoft SharePoint Server Remote Code Execution Vulnerability

Overview

Severity

High (CVSS 8.8)

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Category

Remote Code Execution

Exploit Status

Not Exploited

Exploitation Likelihood

More Likely

Patch Tuesday

2022-Feb

Released

2022-02-08

EPSS Score

5.38% (percentile: 90.1%)

FAQ

According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability? The attacker must be authenticated and possess the permissions for page creation to be able to exploit this vulnerability.

Affected Products (4)

Microsoft Office

• Microsoft SharePoint Enterprise Server 2016
• Microsoft SharePoint Enterprise Server 2013 Service Pack 1
• Microsoft SharePoint Server 2019
• Microsoft SharePoint Server Subscription Edition

Security Updates (4)

• 5002136
• 5002120
• 5002135
• 5002145

Acknowledgments

Anonymous working with <a href="https://www.zerodayinitiative.com/">Trend Micro Zero Day Initiative</a>

Revision History

• 2022-02-08: Information published.