CVE-2022-41033 : Windows COM+ Event System Service Elevation of Privilege Vulnerability

Windows COM+ Event System Service Elevation of Privilege Vulnerability

Published 2022-10-11 19:15:21

Updated 2023-12-20 20:15:18

Source Microsoft Corporation

View at NVD, CVE.org

Vulnerability category: Gain privilege

CVE-2022-41033 is in the CISA Known Exploited Vulnerabilities Catalog

CISA vulnerability name:

Microsoft Windows COM+ Event System Service Privilege Escalation Vulnerability

CISA required action:

Apply updates per vendor instructions.

CISA description:

Microsoft Windows COM+ Event System Service contains an unspecified vulnerability that allows for privilege escalation.

Notes:

https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-41033

Added on 2022-10-11 Action due date 2022-11-01

Exploit prediction scoring system (EPSS) score for CVE-2022-41033

Probability of exploitation activity in the next 30 days: 0.11%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 44 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2022-41033

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	Microsoft Corporation
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2022-41033

CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')

The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2022-41033

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41033

CVE-2022-41033 - Security Update Guide - Microsoft - Windows COM+ Event System Service Elevation of Privilege Vulnerability
Patch;Vendor Advisory

Products affected by CVE-2022-41033