Main Vulnerability Database Vulnerabilities #VU60410

Deserialization of Untrusted Data in Microsoft products - CVE-2022-22005

Published: February 8, 2022 / Updated: February 16, 2022

Vulnerability identifier: #VU60410

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-22005

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data stored in client-side templates. A remote user can send specially crafted data to the application and execute arbitrary code on the target system in the context of the SharePoint web server process..

Affected software

Microsoft SharePoint Server Subscription Edition
Microsoft SharePoint Server
Microsoft SharePoint Enterprise Server

How to mitigate CVE-2022-22005

Install updates from vendor's website.

External References

Related Security Bulletins