Vulnerability Details : CVE-2022-30190

Public exploit exists!
Used for ransomware!
A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights. Please see the MSRC Blog Entry for important information about steps you can take to protect your system from this vulnerability.
Published 2022-06-01 20:15:08
Updated 2025-01-02 19:16:22
Source Microsoft Corporation
View at NVD,   CVE.org
Vulnerability category: Execute code

Products affected by CVE-2022-30190

CVE-2022-30190 is in the CISA Known Exploited Vulnerabilities Catalog

This issue is known to have been leveraged as part of a ransomware campaign.
CISA vulnerability name:
Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
CISA required action:
Apply updates per vendor instructions.
CISA description:
A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run code with the privileges of the calling application.
Notes:
https://nvd.nist.gov/vuln/detail/CVE-2022-30190
Added on 2022-06-14 Action due date 2022-07-05

Exploit prediction scoring system (EPSS) score for CVE-2022-30190

EPSS FAQ
93.38%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 100 %
Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2022-30190

  • Microsoft Office Word MSDTJS
    Disclosure Date: 2022-05-29
    First seen: 2022-12-23
    exploit/windows/fileformat/word_msdtjs_rce
    This module generates a malicious Microsoft Word document that when loaded, will leverage the remote template feature to fetch an `HTML` document and then use the `ms-msdt` scheme to execute `PowerShell` code.

CVSS scores for CVE-2022-30190

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
9.3
 HIGH AV:N/AC:M/Au:N/C:C/I:C/A:C
8.6
10.0
 NIST
7.8
 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1.8
5.9
 NIST
7.8
 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1.8
5.9
 Microsoft Corporation

CWE ids for CVE-2022-30190

References for CVE-2022-30190

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close