CVE-2022-41104
published 2022-11-09CVE-2022-41104: Microsoft Excel Security Feature Bypass Vulnerability
PriorityP423medium5.5CVSS 3.1
AVLACLPRNUIRSUCHINAN
EPSS
0.74%
50.6th percentile
Microsoft Excel Security Feature Bypass Vulnerability
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | excel | — | — |
| microsoft | excel | — | — |
| microsoft | microsoft_365_apps_for_enterprise | >= 16.0.1 < https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases |
| microsoft | microsoft_excel_2013_service_pack_1 | >= 15.0.0.0 < 15.0.5501.1000 | 15.0.5501.1000 |
| microsoft | microsoft_excel_2016 | >= 16.0.0.0 < 16.0.5369.1000 | 16.0.5369.1000 |
| microsoft | microsoft_office_2019 | >= 19.0.0 < https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases |
| microsoft | microsoft_office_ltsc_2021 | >= 16.0.1 < https://aka.ms/OfficeSecurityReleases | https://aka.ms/OfficeSecurityReleases |
| microsoft | office | — | — |
| microsoft | office_long_term_servicing_channel | — | — |
| msrc | microsoft_365_apps_for_enterprise_for_32-bit_systems | — | — |
| msrc | microsoft_365_apps_for_enterprise_for_64-bit_systems | — | — |
| msrc | microsoft_excel_2013_rt_service_pack_1 | — | — |
| msrc | microsoft_excel_2013_service_pack_1 | — | — |
| msrc | microsoft_excel_2016 | — | — |
| msrc | microsoft_office_2019_for_32-bit_editions | — | — |
| msrc | microsoft_office_2019_for_64-bit_editions | — | — |
| msrc | microsoft_office_ltsc_2021_for_32-bit_editions | — | — |
| msrc | microsoft_office_ltsc_2021_for_64-bit_editions | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
vendor_msrc5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Microsoft Excel Security Feature Bypass Vulnerability
vendor_msrc·2022-11-08·CVSS 5.5
CVE-2022-41104 [MEDIUM] Microsoft Excel Security Feature Bypass Vulnerability
Microsoft Excel Security Feature Bypass Vulnerability
FAQ: Is the Preview Pane an attack vector for this vulnerability?
No, the Preview Pane is not an attack vector.
FAQ: According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
Exploitation of the vulnerability requires that a user open a specially crafted file with an affected version of Microsoft Excel.
In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file.
In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) containing a specially crafted file designed to exploit the vulnerability.
VulDB
Microsoft Excel up to Apps for Enterprise information disclosure
vuldb·2026-05-19·CVSS 5.5
CVE-2022-41104 [MEDIUM] Microsoft Excel up to Apps for Enterprise information disclosure
A vulnerability classified as problematic was found in Microsoft Excel 2013 SP1/2013 RT SP1/2016/2021/Apps for Enterprise. This vulnerability affects unknown code. The manipulation results in information disclosure.
This vulnerability is known as CVE-2022-41104. It is possible to launch the attack remotely. No exploit is available.
It is best practice to apply a patch to resolve this issue.
GHSA
GHSA-p48f-x8gv-j9jx: Microsoft Excel Security Feature Bypass Vulnerability
ghsa_unreviewed·2022-11-10
CVE-2022-41104 [MEDIUM] GHSA-p48f-x8gv-j9jx: Microsoft Excel Security Feature Bypass Vulnerability
Microsoft Excel Security Feature Bypass Vulnerability.
No detection rules found.
No public exploits indexed.
2022-11-09
Published