7.8

CVE-2022-21999

Warnung

Windows Print Spooler Elevation of Privilege Vulnerability

Windows Print Spooler Elevation of Privilege Vulnerability
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Microsoft ≫ Windows 10 1507 Version < 10.0.10240.19204
Microsoft ≫ Windows 10 1607 Version < 10.0.14393.4946
Microsoft ≫ Windows 10 1809 Version < 10.0.17763.2565
Microsoft ≫ Windows 10 1909 Version < 10.0.18363.2094
Microsoft ≫ Windows 10 20h2 Version < 10.0.19042.1526
Microsoft ≫ Windows 10 21h1 Version < 10.0.19043.1526
Microsoft ≫ Windows 10 21h2 Version < 10.0.19044.1526
Microsoft ≫ Windows 11 21h2 Version < 10.0.22000.493
Microsoft ≫ Windows 7 Version- Updatesp1
Microsoft ≫ Windows 8.1 Version-
Microsoft ≫ Windows Rt 8.1 Version-
Microsoft ≫ Windows Server 2008 Version- Updatesp2
Microsoft ≫ Windows Server 2008 Versionr2 Updatesp1 HwPlatformx64
Microsoft ≫ Windows Server 2016 Version < 10.0.14393.4946
Microsoft ≫ Windows Server 2019 Version < 10.0.17763.2565
Microsoft ≫ Windows Server 2022 Version < 10.0.20348.524
Microsoft ≫ Windows Server 20h2 Version < 10.0.19042.1526

25.03.2022: CISA Known Exploited Vulnerabilities (KEV) Catalog

Microsoft Windows Print Spooler Privilege Escalation Vulnerability

Schwachstelle

Microsoft Windows Print Spooler contains an unspecified vulnerability which can allow for privilege escalation.

Beschreibung

Apply updates per vendor instructions.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 71.51% 0.987
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.6 3.9 6.4
AV:L/AC:L/Au:N/C:P/I:P/A:P
secure@microsoft.com 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

CWE-59 Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.