Information disclosure in Microsoft Excel
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2022-22716 |
| CWE-ID | CWE-200 |
| Exploitation vector | Local |
| Public exploit | N/A |
| Vulnerable software |
Microsoft SharePoint Server Server applications / Application servers Microsoft Office Web Apps Server Server applications / Application servers Microsoft Office Client/Desktop applications / Office applications Microsoft Excel Client/Desktop applications / Office applications Microsoft 365 Apps for Enterprise Client/Desktop applications / Office applications Office Online Server Server applications / Other server solutions Microsoft Office LTSC 2021 Other software / Other software solutions |
| Vendor | Microsoft |
Security Bulletin
This security bulletin contains one low risk vulnerability.
1) Information disclosure
EUVDB-ID: #VU60420
Risk: Low
CVSSv4.0: [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-22716
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application in Microsoft Excel. A local user can gain unauthorized access to sensitive information on the system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsMicrosoft SharePoint Server: 2013
Microsoft Office: 2019 for Mac - 2019
Office Online Server: 2016
Microsoft Excel: 2013 RT Service Pack 1 - 2016
Microsoft Office Web Apps Server: 2013 Service Pack 1
Microsoft Office LTSC 2021: 32 bit editions - 2021 for Mac
Microsoft 365 Apps for Enterprise: 32-bit Systems - 64-bit Systems
CPE2.3- cpe:2.3:a:microsoft:microsoft_sharepoint_server:2013:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:microsoft_office:*:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:office_online_server:2016:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:microsoft_excel:2013 RT Service Pack 1:*:*:*:*:microsoft_office:*:*
- cpe:2.3:a:microsoft:microsoft_excel:*:*:*:*:*:microsoft_office:*:*
- cpe:2.3:a:microsoft:microsoft_office_web_apps_server:2013 Service Pack 1:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:microsoft_office_ltsc_2021:32:bit editions:*:*:*:*:*:*
- cpe:2.3:a:microsoft:microsoft_office_ltsc_2021:64:bit editions:*:*:*:*:*:*
- cpe:2.3:a:microsoft:microsoft_office_ltsc_2021:2021:for Mac:*:*:*:*:*:*
- cpe:2.3:a:microsoft:microsoft_365_apps_for_enterprise:32-bit Systems:*:*:*:*:*:*:*
http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-22716
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
