Path traversal in Microsoft Windows and Windows Server - CVE-2022-29114

Vulnerability identifier: #VU62942

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-29114

CWE-ID: CWE-22

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to path traversal in Windows Print Spooler. A local user can gain obtain contents of arbitrary files on the system and view them with SYSTEM privileges.

Microsoft Windows
Windows Server
Solutions Enabler
Unisphere 360
Unisphere for PowerMax
Unisphere for PowerMax Virtual Appliance
eVASA Provider Virtual Appliance
VASA Provider Standalone
Solutions Enabler Virtual Appliance

Install update from vendor's website.

Solutions Enabler - update to 9.2.3.5
Solutions Enabler Virtual Appliance - update to 9.2.3.5
Unisphere 360 - update to 9.2.3.8
Unisphere for PowerMax - update to 9.2.3.20
Unisphere for PowerMax Virtual Appliance - update to 9.2.3.20
eVASA Provider Virtual Appliance - update to 9.2.4.11
VASA Provider Standalone - update to 9.2.4.21

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29114
• https://www.zerodayinitiative.com/advisories/ZDI-22-736/

• Multiple vulnerabilities in Microsoft Windows Print Spooler
• Multiple vulnerabilities in Dell products