CVE-2022-30209
Published: 12 July 2022
Summary
CVE-2022-30209 is a high-severity an unspecified weakness vulnerability in Microsoft Windows 10. Its CVSS base score is 7.4 (High).
Operationally, ranked in the top 13.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Windows IIS Server contains an elevation of privilege vulnerability tracked as CVE-2022-30209. The flaw affects the Windows Internet Information Services component and received a CVSS 3.1 score of 7.4 with a network attack vector, high attack complexity, and no required privileges or user interaction, resulting in high impact to confidentiality and integrity.
An unauthenticated remote attacker can exploit the issue over the network to obtain elevated privileges on the affected IIS server, though successful exploitation requires conditions that increase complexity. The vulnerability does not impact availability.
Microsoft has published guidance and patches through its Security Response Center at the referenced URLs. The associated EPSS score rose from a low baseline to a peak of 0.0686 before receding to its current value of 0.0303, indicating a period of increased exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-35415
Vulnerability details
Windows IIS Server Elevation of Privilege Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.