⚠ Actively exploited in ransomware campaigns
This vulnerability is on the CISA Known Exploited Vulnerabilities list and has been used in known ransomware attacks. CISA required action: Apply updates per vendor instructions.. Due date: 2022-12-09.

CVE-2022-41091

CWE-863 — Incorrect Authorization6 documents6 sources
Severity
5.4MEDIUM
EPSS
7.4%
top 8.26%
CISA KEV
KEVRansomware
Added 2022-11-08
Due 2022-12-09
Exploit
Exploited in wild
Active exploitation observed
Affected products
23
Microsoft Windows 10 Version 1507Microsoft Windows 10 Version 1607Microsoft Windows 10 Version 1809+20 more
Timeline
KEV addedNov 8
PublishedNov 9
Latest updateNov 10
KEV dueDec 9
CISA Required Action: Apply updates per vendor instructions.

Description

Windows Mark of the Web Security Feature Bypass Vulnerability

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:LExploitability: 2.8 | Impact: 2.5

Affected Packages24 packages

▶NVDmicrosoft/windows< 10.0.14393.5501+2
▶NVDmicrosoft/windows_10_1507< 10.0.10240.19567
▶NVDmicrosoft/windows_10_1607< 10.0.14393.5501
▶NVDmicrosoft/windows_10_1809< 10.0.17763.3650
▶NVDmicrosoft/windows_10_20h2< 10.0.19042.2251

Patches

Patch: msrc.microsoft.com ↗Patch: msrc.microsoft.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-ccv7-v4mw-3wqq: Windows Mark of the Web Security Feature Bypass Vulnerability↗2022-11-10
▶
CVEList
Windows Mark of the Web Security Feature Bypass Vulnerability↗2022-11-09
▶
VulnCheck
Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability↗2022
▶

📋Vendor Advisories

2
CISA
Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability↗2022-11-08
▶
Microsoft
Windows Mark of the Web Security Feature Bypass Vulnerability↗2022-11-08
▶
CVE-2022-41091 (MEDIUM CVSS 5.4) | Windows Mark of the Web Security Fe | cvebase.io