CVE-2022-24539
Published: 15 April 2022
Summary
CVE-2022-24539 is a high-severity an unspecified weakness vulnerability in Microsoft Windows Server 2016. Its CVSS base score is 8.1 (High).
Operationally, ranked in the top 4.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Windows Hyper-V contains an information disclosure vulnerability tracked as CVE-2022-24539 that affects shared virtual hard disks. The flaw received a CVSS 3.1 score of 8.1 with network attack vector, low complexity, and low privileges required, resulting in high impact to confidentiality and availability.
An authenticated attacker with low privileges can exploit the issue over the network without user interaction to obtain sensitive information from shared virtual hard disk configurations and to disrupt availability. The vulnerability resides in the Hyper-V component responsible for handling these shared disks on affected Windows systems.
Microsoft has published official guidance and patches for the vulnerability through its Security Response Center at the listed advisory URL. The associated EPSS score has remained flat at 0.1804 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-29419
Vulnerability details
Windows Hyper-V Shared Virtual Hard Disks Information Disclosure Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.