CVE-2022-41043: Microsoft Office Information Disclosure Vulnerability

Overview

Severity
Low (CVSS 3.3)
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C
Category
Information Disclosure
Exploit Status
Not Exploited
Exploitation Likelihood
Less Likely
Publicly Disclosed
Yes
Patch Tuesday
2022-Oct
Released
2022-10-11
Last Updated
2022-12-13
EPSS Score
1.43% (percentile: 80.6%)

FAQ

What type of information could be disclosed by this vulnerability? The type of information that could be disclosed if an attacker successfully exploited this vulnerability is user tokens and other potentially sensitive information. According to the CVSS metric, the attack vector is local (AV:L). What does this mean for this vulnerability? The attacker would have to be an authenticated user logged on to the vulnerable system to be able to exploit this vulnerability. According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability? The attacker must be authenticated to be able to exploit this vulnerability. Is the Preview Pane an attack vector for this vulnerability? No, the Preview Pane is not an attack vector.

Affected Products (2)

Microsoft Office

  • Microsoft Office 2019 for Mac
  • Microsoft Office LTSC for Mac 2021

Security Updates (1)

Acknowledgments

Spotlight, <a href="https://twitter.com/its_a_feature_">Cody Thomas</a> with <a href="https://specterops.io/">SpecterOps</a>

Revision History

  • 2022-10-11: Information published.
  • 2022-12-13: Updated FAQ information. This is an informational change only.