7.8

CVE-2022-41033

Warning

Windows COM+ Event System Service Elevation of Privilege Vulnerability

Data is provided by the National Vulnerability Database (NVD)
Microsoft ≫ Windows 10 1507 Version < 10.0.10240.19507
Microsoft ≫ Windows 10 1607 Version < 10.0.14393.5427
Microsoft ≫ Windows 10 1809 Version < 10.0.17763.3532
Microsoft ≫ Windows 10 20h2 Version < 10.0.19042.2130
Microsoft ≫ Windows 10 21h1 Version < 10.0.19043.2130
Microsoft ≫ Windows 10 21h2 Version < 10.0.19044.2130
Microsoft ≫ Windows 11 21h2 Version < 10.0.22000.1098
Microsoft ≫ Windows 11 22h2 Version < 10.0.22621.674
Microsoft ≫ Windows 7 Version- Updatesp1
Microsoft ≫ Windows 8.1 Version-
Microsoft ≫ Windows Rt 8.1 Version-
Microsoft ≫ Windows Server 2008 Version- Updatesp2
Microsoft ≫ Windows Server 2008 Versionr2 Updatesp1 HwPlatformx64
Microsoft ≫ Windows Server 2016 Version < 10.0.14393.5427
Microsoft ≫ Windows Server 2019 Version < 10.0.17763.3532
Microsoft ≫ Windows Server 2022 Version < 10.0.20348.1129

11.10.2022: CISA Known Exploited Vulnerabilities (KEV) Catalog

Microsoft Windows COM+ Event System Service Privilege Escalation Vulnerability

Vulnerability

Microsoft Windows COM+ Event System Service contains an unspecified vulnerability that allows for privilege escalation.

Description

Apply updates per vendor instructions.

Required actions
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.22% 0.442
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
secure@microsoft.com 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')

The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.