CVE-2022-30146
Published: 15 June 2022
Summary
CVE-2022-30146 is a high-severity an unspecified weakness vulnerability in Microsoft Windows 10. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 10.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2022-30146 is a remote code execution vulnerability in the Windows Lightweight Directory Access Protocol (LDAP) client component. The flaw received a CVSS 3.1 base score of 7.5 and affects LDAP operations that can be triggered over the network.
An unauthenticated remote attacker can exploit the issue by supplying a malicious LDAP response that the victim’s Windows system processes. Successful exploitation grants the attacker full code execution with the privileges of the affected user, resulting in complete compromise of confidentiality, integrity, and availability. The attack requires user interaction and presents high attack complexity.
Microsoft has published security updates and guidance addressing the vulnerability through its Security Response Center at the referenced URLs. Administrators should apply the patches corresponding to their Windows versions to eliminate the exposure.
The associated EPSS score has remained flat at 0.0510 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-35354
Vulnerability details
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.