CVE-2022-30190HighMicrosoft CVSS 7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

Microsoft security update for CVE-2022-30190 — Windows

Published
May 30, 2022
Last Modified
—

🔗 CVE IDs covered (1)

CVE-2022-30190 →

📋 Microsoft's advisory

EchelonGraph does not copy Microsoft's advisory page: its FAQ and remediation text are not shown here. Read the advisory on https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30190. This page also shows what EchelonGraph holds for CVE-2022-30190, with the description from its CVE record, which the CVE Numbering Authority that assigned the CVE wrote: for a CVE Microsoft assigned, often in the words of Microsoft's own advisory.

🎯 Affected products35

  • Windows 10 Version 1607 for 32-bit Systems
  • Windows 10 Version 1607 for x64-based Systems
  • Windows 10 Version 1809 for 32-bit Systems
  • Windows 10 Version 1809 for ARM64-based Systems
  • Windows 10 Version 1809 for x64-based Systems
  • Windows 10 Version 20H2 for 32-bit Systems
  • Windows 10 Version 20H2 for ARM64-based Systems
  • Windows 10 Version 21H1 for 32-bit Systems
  • Windows 10 Version 21H1 for ARM64-based Systems
  • Windows 10 Version 21H1 for x64-based Systems
  • Windows 10 Version 21H2 for 32-bit Systems
  • Windows 10 Version 21H2 for ARM64-based Systems
  • Windows 10 Version 21H2 for x64-based Systems
  • Windows 10 for 32-bit Systems
  • Windows 10 for x64-based Systems
  • Windows 11 version 21H2 for ARM64-based Systems
  • Windows 11 version 21H2 for x64-based Systems
  • Windows 7 for 32-bit Systems Service Pack 1
  • Windows 7 for x64-based Systems Service Pack 1
  • Windows 8.1 for 32-bit systems
  • Windows 8.1 for x64-based systems
  • Windows RT 8.1
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
  • Windows Server 2012
  • Windows Server 2012 (Server Core installation)
  • Windows Server 2012 R2
  • Windows Server 2012 R2 (Server Core installation)
  • Windows Server 2016
  • Windows Server 2016 (Server Core installation)
  • +5 more not shown

✅ Updates Microsoft lists: 12 KB articles

14 rows: one per KB article or update, update type and fixed build. Their details are on Microsoft's advisory.

KB articleUpdateFixed build
KB5014692Security Update10.0.17763.3046
KB5014699Security Update10.0.19043.1766
KB5014678Security Update10.0.20348.770
KB5014699Security Update10.0.19042.1766
KB5014697Security Update10.0.22000.739
KB5014699Security Update10.0.19044.1766
KB5014710Security Update10.0.10240.19325
KB5014702Security Update10.0.14393.5192
KB5014748Monthly Rollup6.1.7601.25984
KB5014742Security Only6.1.7601.25984
KB5014738Monthly Rollup6.3.9600.20402
KB5014746Security Only6.3.9600.20402
KB5014747Monthly Rollup6.2.9200.23736
KB5014741Security Only6.2.9200.23736

🧭 EchelonGraph on CVE-2022-30190

EchelonGraph score
9.0 CRITICAL
CISA KEV
Listed since June 14, 2022
Fix status
A fix is available — apply it.

Description from the CVE record (CVE.org), as published by its numbering authority

A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights. Please see the MSRC Blog Entry for important information about steps you can take to protect your system from this vulnerability.

Published by Microsoft Corporation, the CVE Numbering Authority that assigned CVE-2022-30190, in its CVE record at CVE.org; reused under the CVE Program's Terms of Use (its licence and MITRE's copyright notice are in our Terms of Service).

🔗 References (25)