CVE-2022-21837

Deeper analysis

Microsoft SharePoint Server is affected by CVE-2022-21837, a remote code execution vulnerability disclosed on 11 January 2022. The flaw carries a CVSS 3.1 base score of 8.3 with network attack vector, low complexity, and low privileges required, enabling an authenticated attacker to execute arbitrary code that yields high impact on confidentiality and integrity along with low impact on availability.

An attacker who already possesses low-privileged access to a SharePoint deployment can send crafted requests over the network to trigger the vulnerability and obtain code execution on the server without user interaction. Successful exploitation allows the attacker to read or modify sensitive data and potentially disrupt service operations within the affected SharePoint environment.

Microsoft security advisories for CVE-2022-21837 direct administrators to apply the patches released in the corresponding security update packages. The EPSS score reached a peak of 0.0959 and currently sits at 0.0769, indicating modest post-disclosure interest that does not constitute a pronounced rise.