CVE-2022-38033

Deeper analysis

Windows Server contains a remotely accessible registry keys information disclosure vulnerability tracked as CVE-2022-38033. The flaw affects Windows Server components that expose registry keys over the network, allowing unauthorized access to sensitive configuration data without requiring elevated privileges on the target system.

An authenticated attacker with low privileges can exploit the issue over the network with low attack complexity and no user interaction. Successful exploitation results in disclosure of high-value information stored in the registry while leaving integrity and availability unaffected, corresponding to the reported CVSS 6.5 rating.

Microsoft security advisories for CVE-2022-38033, available at the listed MSRC URLs, describe the vulnerability and direct administrators to apply the corresponding security updates released in October 2022. The EPSS score has remained in a moderate range with a recorded peak of 0.1732 and current value of 0.1535, indicating no pronounced post-disclosure surge in exploitation interest.