CVE-2022-37974: Windows Mixed Reality Developer Tools Information Disclosure Vulnerability
CVE-2022-37974 is an information disclosure vulnerability in Windows Mixed Reality Developer Tools, rated Important by Microsoft, with a CVSS 3.1 base score of 6.5 (Medium). An attacker can exploit it remotely over the network, without any privileges and only if a user takes an action. Microsoft has not reported exploitation in the wild and rates exploitation as more likely. The EPSS model estimates a 36.49% probability of exploitation activity in the next 30 days, higher than 99% of all scored vulnerabilities. Microsoft released the fix on 11 October 2022 in the October 2022 Patch Tuesday, delivered through 3 security updates (KB5018410, KB5018418, KB5018427). It affects 4 products in 1 product family (Windows).
Key facts
- CVE ID
- CVE-2022-37974
- Severity
- Medium CVSS 6.5
- Microsoft severity
- Important
- Impact
- Information Disclosure
- Exploited in the wild
- No
- Publicly disclosed
- No
- Exploitation likelihood
- More Likely
- EPSS
- 36.49% (percentile 99%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- October 2022 Patch Tuesday
- Product families
- Windows
CVSS score and vector
Microsoft scores CVE-2022-37974 at 6.5 (temporal 5.7) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
| Metric | Value |
|---|---|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Required |
| Scope | Unchanged |
| Confidentiality impact | High |
| Integrity impact | None |
| Availability impact | None |
| Exploit code maturity | Unproven |
| Remediation level | Official fix |
| Report confidence | Confirmed |
Frequently asked questions (Microsoft)
What type of information could be disclosed by this vulnerability?
The type of information that could be disclosed if an attacker successfully exploited this vulnerability is unauthorized file system access - reading from the file system.
How could an attacker exploit this vulnerability?
An attacker could exploit this vulnerability by convincing a user to click a specially crafted link. The vulnerable system could then send attacker-specified files, to which the targeted user has access, across the network to a remote system.
Affected products (4)
Windows
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| Windows 10 Version 21H1 for x64-based Systems | KB5018410 | Security Update | 10.0.19043.2130 | Yes |
| Windows 11 version 21H2 for x64-based Systems | KB5018418 | Security Update | 10.0.22000.1098 | Yes |
| Windows 10 Version 21H2 for x64-based Systems | ||||
| Windows 11 Version 22H2 for x64-based Systems | KB5018427 | Security Update | 10.0.22621.674 | Yes |
Security updates (3)
NIST NVD data
- NVD status
- Modified
- NVD CVSS
- 6.5 (MEDIUM)
- Published to NVD
- NVD last modified
Affected configurations (CPE)
| Product | Vulnerable versions |
|---|---|
| windows 10 20h2 (x64) | all listed versions |
| windows 10 21h1 (x64) | all listed versions |
| windows 10 21h2 (x64) | all listed versions |
| windows 11 (x64) | all listed versions |
| windows 11 22h2 (x64) | all listed versions |
References
Acknowledgments
- Microsoft Offensive Research & Security Engineering (MORSE)
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. |