7.8

CVE-2022-21999

Warning

Windows Print Spooler Elevation of Privilege Vulnerability

Data is provided by the National Vulnerability Database (NVD)
Microsoft ≫ Windows 10 1507 Version < 10.0.10240.19204
Microsoft ≫ Windows 10 1607 Version < 10.0.14393.4946
Microsoft ≫ Windows 10 1809 Version < 10.0.17763.2565
Microsoft ≫ Windows 10 1909 Version < 10.0.18363.2094
Microsoft ≫ Windows 10 20h2 Version < 10.0.19042.1526
Microsoft ≫ Windows 10 21h1 Version < 10.0.19043.1526
Microsoft ≫ Windows 10 21h2 Version < 10.0.19044.1526
Microsoft ≫ Windows 11 21h2 Version < 10.0.22000.493
Microsoft ≫ Windows 7 Version- Updatesp1
Microsoft ≫ Windows 8.1 Version-
Microsoft ≫ Windows Rt 8.1 Version-
Microsoft ≫ Windows Server 2008 Version- Updatesp2
Microsoft ≫ Windows Server 2008 Versionr2 Updatesp1 HwPlatformx64
Microsoft ≫ Windows Server 2016 Version < 10.0.14393.4946
Microsoft ≫ Windows Server 2019 Version < 10.0.17763.2565
Microsoft ≫ Windows Server 2022 Version < 10.0.20348.524
Microsoft ≫ Windows Server 20h2 Version < 10.0.19042.1526

25.03.2022: CISA Known Exploited Vulnerabilities (KEV) Catalog

Microsoft Windows Print Spooler Privilege Escalation Vulnerability

Vulnerability

Microsoft Windows Print Spooler contains an unspecified vulnerability which can allow for privilege escalation.

Description

Apply updates per vendor instructions.

Required actions
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 73.68% 0.988
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 4.6 3.9 6.4
AV:L/AC:L/Au:N/C:P/I:P/A:P
secure@microsoft.com 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

CWE-59 Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.