CVE-2022-21907

HTTP Protocol Stack Remote Code Execution Vulnerability

CVSS v3 9.8 CRITICAL
CVSS v2.0 10.0 HIGH

9.8^/10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

10.0^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21907
http://packetstormsecurity.com/files/166730/Microsoft-HTTP-Protocol-Stack-Denial-Of-Service.html
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21907

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:microsoft:windows_10:20h2::::::arm64:
	cpe:2.3:o:microsoft:windows_10:20h2::::::x64:
	cpe:2.3:o:microsoft:windows_10:20h2::::::x86:
	cpe:2.3:o:microsoft:windows_10:21h1::::::arm64:
	cpe:2.3:o:microsoft:windows_10:21h1::::::x64:
	cpe:2.3:o:microsoft:windows_10:21h1::::::x86:
	cpe:2.3:o:microsoft:windows_10:21h2::::::arm64:
	cpe:2.3:o:microsoft:windows_10:21h2::::::x64:
	cpe:2.3:o:microsoft:windows_10:21h2::::::x86:
	cpe:2.3:o:microsoft:windows_10:1809::::::arm64:
	cpe:2.3:o:microsoft:windows_10:1809::::::x64:
	cpe:2.3:o:microsoft:windows_10:1809::::::x86:
	cpe:2.3:o:microsoft:windows_11:-::::::arm64:
	cpe:2.3:o:microsoft:windows_11:-::::::x64:
	cpe:2.3:o:microsoft:windows_server:20h2:::::::*
	cpe:2.3:o:microsoft:windows_server:2022:::::::*
	cpe:2.3:o:microsoft:windows_server_2019:-:::::::*

History

21 Nov 2024, 06:45

Type	Values Removed	Values Added
References		() http://packetstormsecurity.com/files/166730/Microsoft-HTTP-Protocol-Stack-Denial-Of-Service.html - () https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21907 -

14 Nov 2024, 21:15

Type	Values Removed	Values Added
References	~~{'url': 'http://packetstormsecurity.com/files/166730/Microsoft-HTTP-Protocol-Stack-Denial-Of-Service.html', 'tags': ['Exploit', 'Third Party Advisory', 'VDB Entry'], 'source': 'secure@microsoft.com'}~~ ~~{'url': 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21907', 'tags': ['Mitigation', 'Patch', 'Vendor Advisory'], 'source': 'secure@microsoft.com'}~~	() https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21907 -

21 Dec 2023, 01:15

Type	Values Removed	Values Added
Summary	~~HTTP Protocol Stack Remote Code Execution Vulnerability.~~	HTTP Protocol Stack Remote Code Execution Vulnerability

20 Aug 2022, 17:15

Type	Values Removed	Values Added
References	{'url': 'http://packetstormsecurity.com/files/165566/HTTP-Protocol-Stack-Denial-Of-Service-Remote-Code-Execution.html', 'name': 'http://packetstormsecurity.com/files/165566/HTTP-Protocol-Stack-Denial-Of-Service-Remote-Code-Execution.html', 'tags': ['Exploit', 'Third Party Advisory', 'VDB Entry'], 'refsource': 'MISC'}

10 Aug 2022, 20:15

Type	Values Removed	Values Added
References	{'url': 'https://github.com/nu11secur1ty/Windows10Exploits/tree/master/2022/CVE-2022-21907', 'name': 'https://github.com/nu11secur1ty/Windows10Exploits/tree/master/2022/CVE-2022-21907', 'tags': ['Exploit', 'Third Party Advisory'], 'refsource': 'MISC'} {'url': 'https://www.nu11secur1ty.com/2022/01/cve-2022-21907.html', 'name': 'https://www.nu11secur1ty.com/2022/01/cve-2022-21907.html', 'tags': ['Exploit', 'Third Party Advisory'], 'refsource': 'MISC'}

27 Apr 2022, 18:52

Type	Values Removed	Values Added
References	~~(MISC) http://packetstormsecurity.com/files/165566/HTTP-Protocol-Stack-Denial-Of-Service-Remote-Code-Execution.html - Exploit, Third Party Advisory~~	(MISC) http://packetstormsecurity.com/files/165566/HTTP-Protocol-Stack-Denial-Of-Service-Remote-Code-Execution.html - Exploit, Third Party Advisory, VDB Entry
References	~~(MISC) http://packetstormsecurity.com/files/166730/Microsoft-HTTP-Protocol-Stack-Denial-Of-Service.html -~~	(MISC) http://packetstormsecurity.com/files/166730/Microsoft-HTTP-Protocol-Stack-Denial-Of-Service.html - Exploit, Third Party Advisory, VDB Entry

15 Apr 2022, 18:15

Type	Values Removed	Values Added
References		(MISC) http://packetstormsecurity.com/files/166730/Microsoft-HTTP-Protocol-Stack-Denial-Of-Service.html -

19 Jan 2022, 18:49

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~9.8~~	v2 : 10.0 v3 : 9.8
References	~~(MISC) https://github.com/nu11secur1ty/Windows10Exploits/tree/master/2022/CVE-2022-21907 -~~	(MISC) https://github.com/nu11secur1ty/Windows10Exploits/tree/master/2022/CVE-2022-21907 - Exploit, Third Party Advisory
References	~~(MISC) http://packetstormsecurity.com/files/165566/HTTP-Protocol-Stack-Denial-Of-Service-Remote-Code-Execution.html -~~	(MISC) http://packetstormsecurity.com/files/165566/HTTP-Protocol-Stack-Denial-Of-Service-Remote-Code-Execution.html - Exploit, Third Party Advisory
References	~~(MISC) https://www.nu11secur1ty.com/2022/01/cve-2022-21907.html -~~	(MISC) https://www.nu11secur1ty.com/2022/01/cve-2022-21907.html - Exploit, Third Party Advisory
References	~~(MISC) https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21907 -~~	(MISC) https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21907 - Mitigation, Patch, Vendor Advisory
CWE		NVD-CWE-noinfo
CPE		cpe:2.3:o:microsoft:windows_10:21h2::::::x64: cpe:2.3:o:microsoft:windows_10:21h2::::::arm64: cpe:2.3:o:microsoft:windows_10:1809::::::arm64: cpe:2.3:o:microsoft:windows_10:1809::::::x64: cpe:2.3:o:microsoft:windows_10:21h1::::::x64: cpe:2.3:o:microsoft:windows_10:20h2::::::x86: cpe:2.3:o:microsoft:windows_10:20h2::::::x64: cpe:2.3:o:microsoft:windows_server:20h2:::::::* cpe:2.3:o:microsoft:windows_server:2022:::::::* cpe:2.3:o:microsoft:windows_10:21h1::::::x86: cpe:2.3:o:microsoft:windows_11:-::::::x64: cpe:2.3:o:microsoft:windows_11:-::::::arm64: cpe:2.3:o:microsoft:windows_10:21h2::::::x86: cpe:2.3:o:microsoft:windows_10:21h1::::::arm64: cpe:2.3:o:microsoft:windows_10:20h2::::::arm64: cpe:2.3:o:microsoft:windows_10:1809::::::x86: cpe:2.3:o:microsoft:windows_server_2019:-:::::::*

17 Jan 2022, 20:15

Type	Values Removed	Values Added
References		(MISC) http://packetstormsecurity.com/files/165566/HTTP-Protocol-Stack-Denial-Of-Service-Remote-Code-Execution.html -

13 Jan 2022, 18:15

Type	Values Removed	Values Added
References		(MISC) https://github.com/nu11secur1ty/Windows10Exploits/tree/master/2022/CVE-2022-21907 - (MISC) https://www.nu11secur1ty.com/2022/01/cve-2022-21907.html -

11 Jan 2022, 21:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-01-11 21:15

Updated : 2024-11-21 06:45

NVD link : CVE-2022-21907

Mitre link : CVE-2022-21907

CVE.ORG link : CVE-2022-21907

JSON object : View

Products Affected

microsoft

windows_11
windows_server_2019
windows_10
windows_server

CWE

NVD-CWE-noinfo

9.8 /10