CVE-2022-30171
Published: 15 June 2022
Summary
CVE-2022-30171 is a medium-severity an unspecified weakness vulnerability in Microsoft Sharepoint Server. Its CVSS base score is 5.5 (Medium).
Operationally, ranked in the top 10.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Microsoft Office contains an information disclosure vulnerability tracked as CVE-2022-30171. The flaw received a CVSS 3.1 score of 5.5 with the vector string AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, indicating that successful exploitation can expose sensitive data from the affected application while requiring local access and user interaction.
An attacker who can supply a malicious file or document to a local user may leverage the issue to read information that would otherwise remain protected. No privileges are required beyond the ability to interact with the victim on the same system, and the attack does not impact integrity or availability.
Microsoft has published official guidance and mitigation details for CVE-2022-30171 through its Security Response Center and update portal. The EPSS score for the vulnerability rose from a low baseline to a recorded peak of 0.0615 on 2025-12-11 before receding to the current value of 0.0427, indicating a measurable but modest increase in observed exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-35379
Vulnerability details
Microsoft Office Information Disclosure Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.