CVE-2022-30159
Published: 15 June 2022
Summary
CVE-2022-30159 is a medium-severity an unspecified weakness vulnerability in Microsoft Sharepoint Server. Its CVSS base score is 5.5 (Medium).
Operationally, ranked in the top 10.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Microsoft Office is affected by an information disclosure vulnerability tracked as CVE-2022-30159. The flaw carries a CVSS 3.1 score of 5.5 reflecting local attack vector, low complexity, no required privileges, and required user interaction, with high impact limited to confidentiality.
An attacker can exploit the issue by supplying a crafted document that a user opens locally, resulting in unauthorized exposure of sensitive information from the affected system without further privileges or remote access.
Microsoft security advisories at the listed MSRC URLs provide official guidance and patches for the vulnerability. The EPSS score rose from lower values to a recorded peak of 0.0600 on 2025-12-11 before receding to the current 0.0445, indicating a measurable increase in exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-35367
Vulnerability details
Microsoft Office Information Disclosure Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.