Kaspersky LabKLA12507KLA12507 Multiple vulnerabilities in Microsoft Office
8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
7.8 High
AI Score
Confidence
High
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.017 Low
EPSS
Percentile
87.6%
Detect date:
04/12/2022
Severity:
High
Description:
Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to execute arbitrary code, spoof user interface, obtain sensitive information.
Exploitation:
Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.
Affected products:
Skype for Business Server 2019 CU6
Skype for Business Server 2015 CU12
Microsoft Lync Server 2013 CU10
Solution:
Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)
Original advisories:
CVE-2022-26901
CVE-2022-26903
CVE-2022-24473
CVE-2022-24472
CVE-2022-26911
CVE-2022-26910
Impacts:
ACE
Related products:
CVE-IDS:
CVE-2022-269037.8Critical
CVE-2022-269017.8Critical
CVE-2022-244737.8Critical
CVE-2022-244728.0Critical
CVE-2022-269116.5High
CVE-2022-269105.3High
KB list:
5002162
5002148
5002143
5002180
5002177
5002189
5012686
5002175
5002169
5002191
5002183
5012681
Microsoft official advisories:
References
support.microsoft.com/kb/5002143
support.microsoft.com/kb/5002148
support.microsoft.com/kb/5002162
support.microsoft.com/kb/5002169
support.microsoft.com/kb/5002175
support.microsoft.com/kb/5002177
support.microsoft.com/kb/5002180
support.microsoft.com/kb/5002183
support.microsoft.com/kb/5002189
support.microsoft.com/kb/5002191
support.microsoft.com/kb/5012681
support.microsoft.com/kb/5012686
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24472
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24473
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26901
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26903
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26910
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26911
msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24472
msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24473
msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26901
msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26903
msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26910
msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26911
portal.msrc.microsoft.com/en-us/security-guidance
statistics.securelist.com/vulnerability-scan/month
threats.kaspersky.com/en/class/Exploit/
threats.kaspersky.com/en/product/Microsoft-Lync-Server/
threats.kaspersky.com/en/product/Microsoft-Lync/
Related
8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
7.8 High
AI Score
Confidence
High
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.017 Low
EPSS
Percentile
87.6%