CVE-2022-41035: Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2022-41035 is an edge - chromium vulnerability in Microsoft Edge (Chromium-based), rated Moderate by Microsoft, with a CVSS 3.1 base score of 5.3 (Medium). An attacker can exploit it remotely over the network, without any privileges and only if a user takes an action. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 1.78% probability of exploitation activity in the next 30 days, higher than 78% of all scored vulnerabilities. Microsoft released the fix on 3 October 2022 in the October 2022 Patch Tuesday. It affects 1 product in 1 product family (Browser).
Key facts
- CVE ID
- CVE-2022-41035
- Severity
- Medium CVSS 5.3
- Microsoft severity
- Moderate
- Impact
- Edge - Chromium
- Exploited in the wild
- No
- Publicly disclosed
- No
- Exploitation likelihood
- Less Likely
- Weakness
- CWE-362
- EPSS
- 1.78% (percentile 78%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- October 2022 Patch Tuesday
- Product families
- Browser
CVSS score and vector
Microsoft scores CVE-2022-41035 at 5.3 (temporal 4.6) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
| Metric | Value |
|---|---|
| Attack vector | Network |
| Attack complexity | High |
| Privileges required | None |
| User interaction | Required |
| Scope | Unchanged |
| Confidentiality impact | None |
| Integrity impact | High |
| Availability impact | None |
| Exploit code maturity | Unproven |
| Remediation level | Official fix |
| Report confidence | Confirmed |
Frequently asked questions (Microsoft)
According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to win a race condition.
According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file that is designed to exploit the vulnerability. However, an attacker would have no way to force the user to visit the website. Instead, an attacker would have to convince the user to click a link, typically by way of an enticement in an email or Instant Messenger message, and then convince the user to open the specially crafted file.
Why is the severity for this CVE rated as Moderate, but the CVSS score is 8.3?
Per our severity guidelines, the amount of user interaction or preconditions required to allow this sort of exploitation downgraded the severity. The CVSS scoring system doesn't allow for this type of nuance.
What is the version information for this release?
Microsoft Edge Version
Date Released
Based on Chromium Version
106.0.1370.34
10/03/2022
106.0.5249.61/62
Affected products (1)
Browser
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| Microsoft Edge (Chromium-based) | Release Notes | Security Update | 106.0.1370.34 | No |
NIST NVD data
- NVD status
- Modified
- NVD CVSS
- 5.3 (MEDIUM)
- NVD weakness
- CWE-362
- Published to NVD
- NVD last modified
Affected configurations (CPE)
| Product | Vulnerable versions |
|---|---|
| edge chromium | before 106.0.1370.34 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41035
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41035 (Patch, Vendor Advisory)
- https://security.gentoo.org/glsa/202210-16 (Third Party Advisory)
Acknowledgments
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. | |
| 1.1 | Updated one or more CVSS scores for the affected products. This is an informational change only. |